cefc4524113b2db4a1d44eb33ddc3027d33b9a1a2762eab5eaeeaf0771cbc072

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d04bb3ba2f153a164b2aebb7bebca477_JaffaCakes118.html
Size

73KB
MD5

d04bb3ba2f153a164b2aebb7bebca477
SHA1

2b7d80ab0810aeb235409f1cf8753b1c12f4b73b
SHA256

cefc4524113b2db4a1d44eb33ddc3027d33b9a1a2762eab5eaeeaf0771cbc072
SHA512

008c32b7131c9085c8c88ae306c0ae41a2fd5d11689e5cd3708c8bd40f408e3ae0903c1179efdf0a6aa5faa63b78f61a05bfef52c93982835d04c7a004a824f5
SSDEEP

1536:Sqfqtzxh7BHuAPNuo2GKTj1YD7/DDk4IyxGXi6EYf6bQbbl67HyhzXdqJjgBZwop:SmqjRBnNChA7HyhzMss4Lh9SYR

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
4772	msedge.exe
4772	msedge.exe
2520	identity_helper.exe
2520	identity_helper.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4640	4772	msedge.exe	83
PID 4772 wrote to memory of 4640	4772	msedge.exe	83
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 3996	4772	msedge.exe	85
PID 4772 wrote to memory of 3996	4772	msedge.exe	85
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86
PID 4772 wrote to memory of 2340	4772	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d04bb3ba2f153a164b2aebb7bebca477_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c5646f8,0x7ffc6c564708,0x7ffc6c564718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8929065196432091930,16641900362081121338,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
18447d8109732fd82dc00ffb1a30b187

SHA1
6b0fd70a1609865fe01b3e249347f6515deddaea

SHA256
fd6d55da9a54f348b01e3f6e7dfb92a99000eec605f147dd087e940e828c84f5

SHA512
2525d56ec6f45183a50e2f894cdc04c22c7ee8b6adcb781415398ab2ec11957ecf8e9c0821de1317f12ac9da5125338547e34c28e7a00a64246ebfac489181dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
49e8b0aa1bed90f5bc3accf41cd6f13b

SHA1
f59067f4b57ff59bdb1bd1f61551bfc9a7c87e45

SHA256
a100f791d8142a9a1a1cd1336ca35060d5b5bac42ac5738eecd7b473bc344e2f

SHA512
8f8dbadb56a646a293c8f0047bfdd2b02060a01757696ea54f2ecfd53c71ec04c9b582b53a6ee95065e1d8cc3f6a8f2b2e7e11fe65d6095153b4fc7196891c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01e84d4f891564cb68587eb6f8219a93

SHA1
349db6507bac520ec4a2447414ff1345e491ebd3

SHA256
dfa7b0a977f2f105591623dc782a5071afd29ece9c8e3f18bef3009d2059a2d6

SHA512
197cca17888dbb9041745031428ff6fadbf17ff6ce7b63359337f90f7f5e93e71d78625dacf95cf8f2c8f652f65f04ff16cc0d0bb7a6580bbba06994d1b41cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9aea8a19a53a22284e07f3fab5687cb9

SHA1
a31096e0509af95aa45aecd279d6f052e228ef01

SHA256
e11a07c3232781a588c6b7e94ccaaf1d90a0875f6729bf3b86922cc36292a21e

SHA512
a5d9cf82a2c76a53e1897f36747bcf59f2a281d3e9c4b9fb94e1e92d2df30c4c956efa25d3fc79cd34d782df1d3cc9b8c8aea1e7714ce34cfd42f5f169f8d02c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\faee86c0-b8a6-4919-8aa8-97fd74b5d1f2.tmp

Filesize
2KB

MD5
f63fc9d7c7e7446fc90d3fc9e96c78ed

SHA1
3e758beec2ee0583d3cca1f874d251385e147105

SHA256
4cf13fae537d7b6734938980f0093fdfa2a041ad3aefc7d6360156796282158a

SHA512
8343fc8abf7e19d6daafd72bb872975be15ea80d66910fdbc7bd22aa17b5c9fa299054532f8a87801802be23c8c3c4aadcd0912e477c2221b5938e6251af777e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c85e6cde2364591a9573b240baaaafd

SHA1
1971be0a4d43f770b414b978e948770b839af8d7

SHA256
e76fda1d9fb290db7275784d471fb37a273bfa2b60e4e482a9b37595c391d500

SHA512
973840b134dd80bbb9b858bc388954ded2d7e14a556b3d9edcec890172a73e0d073de67c42e828fc750cb2b5eca229b1d367c07211b272e527ff0cb4f979db8d

Download Submit