03ae6f2bee4edfe8a9bbc9f75e66579627cf37432c6c3878507d7e29320ca404

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d13fb1dbc4d4549117276f0cd82f8d07_JaffaCakes118.html
Size

150KB
MD5

d13fb1dbc4d4549117276f0cd82f8d07
SHA1

ef89b1f4af19ed4573dc896fb9a49a6f9f9dc430
SHA256

03ae6f2bee4edfe8a9bbc9f75e66579627cf37432c6c3878507d7e29320ca404
SHA512

d7ff50fa0ac25ea0ac173b6a4b98b27865bd6cb164678ad76233deb448ae136751579ea2be125d41fca6a0ea5d16e45d21283b655ab7a9ff35e68836f55595bf
SSDEEP

3072:BOxXK2JgMk7nO5XwybngwrNKuXXVGwHfpQlfSDs/8DGUqvzV26ldw3IawSEKNJGj:0x6K95XwybngwrNKuXXVGwHfpQlfSDsl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
5068	msedge.exe
5068	msedge.exe
4708	identity_helper.exe
4708	identity_helper.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3416	5068	msedge.exe	83
PID 5068 wrote to memory of 3416	5068	msedge.exe	83
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 2532	5068	msedge.exe	84
PID 5068 wrote to memory of 3112	5068	msedge.exe	85
PID 5068 wrote to memory of 3112	5068	msedge.exe	85
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86
PID 5068 wrote to memory of 4912	5068	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d13fb1dbc4d4549117276f0cd82f8d07_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda5446f8,0x7ffbda544708,0x7ffbda544718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9117960929913402589,8588212640661141191,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4829218222c8bedb9ffe89dffd37095

SHA1
aae577f33f413ec3d09f2e7ff5d9cc20a602241c

SHA256
49239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b

SHA512
03e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
15e9c4b4eefb3e1c08a010e748e10f58

SHA1
3172378f2c7a00553ce086dbf53fcf3126c5a724

SHA256
07b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000

SHA512
811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9c6f5ee127bdc3c066455e70af624917

SHA1
3984d2ba56dc0c45ec858f4d07aede174b54631f

SHA256
ef981e1b64656d770b1dd48223274a246a8c05a4c4a1ddca5b7461b6540acd0d

SHA512
54f538bef034e9d348be411c518e71b30bc3f2f52d45b6c47ae0aaa47de5d9071ce4612a8ea03eb458a4950793027e3632bdd8a70eefa96c3f1a5f7dc639cd0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f13475833e4616e89771997a89562d53

SHA1
17931f9d7355fcf19440091aa93645a11da24d12

SHA256
8427bc41189953b307722cd1b04d6b669eca80710b38ae722383a9c09063ec82

SHA512
8ee02856f8c8cf6a182ca7d456d161da8f881a8faec655816b8621eceb2f9940ad3f3a0a2130ca85dbc87bdfb92af6528ac538356e653bb5e7fb359b228cb41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f6e189ad6907efc0b274eaea552985b5

SHA1
ea01869a2485ff62304fe639930c4575af7f7575

SHA256
1408c12cb19108becaa516712f17d969791ce69b95fb8981c5c5491c880859aa

SHA512
4bce82c6631ca3e10b109cf4f04961e04105b9968e728be6272b49e3e36902458733dc415ca92b2e39ee5a59418bb670f1dc1dfdea8ffc514e5f3f0c6b1aa8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7eec6a9a9384e7f7acf1e284f1ec63a

SHA1
f6ea5f6aa717af180c821580ebabd545d5d60b74

SHA256
6d06f441a7e0fee358e13c8cc8a1834efc067ca4382dd4dac3ce59e6741844d9

SHA512
387479ea62da993e4da68a068259261cbd76582092205b5c3bf279ad9636a56b7f831d96945e72ec345e7c0a8d834fe6bab9952d3516a81c16580f06085d7104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
264dad734497f3efcb4e73935eb72939

SHA1
ca9d6bab7e04e3a34ea80c5d40ca5710d4ce0cca

SHA256
a21a06e713498a742837a2d97e1054fffcf638beb4156953ce9be2e87e3117e5

SHA512
39794d34d714b6ffa46849bff1caf6a7bbd8ae157c25365c67ec178ac9712f864fd400fedc9c175fb2b2dedbaf8f714eb68cd96b5b95cb7aaa88d9a7aa6bdbca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b185d3e0062d5f516d0a3d84111902b9

SHA1
07a38a4d29d9184adf8bead6fdb27f77946d81ae

SHA256
73be5a4e9534ed4295e26d989d0dc2ab87559f5627dcc2b1e9ba92040f6ed15a

SHA512
8be6d68e6c65ff888cc887d2464be76949d7cf195ef3f574432f4d1a31492645d891a6daae1368c1f7beb4c43136eb28adcfd79aeff82a989012ab62a40c4715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8383362f631fa4afd57b1b993cbcbbf

SHA1
d172c7a8a9d0d372d19b9151be5bab7912b44fc0

SHA256
350db29b2a7dc6381ffe6a16d9807ae938ede6af68a94f37590672ab50dfc7e3

SHA512
72c0c704e65d156a6ec7a3b6a97953bc17f16dc20dc42c454f74eb5c40df917af33b62e0ef62849f49fda6ac82998b4185c8f48c6e049eca6f233bbd1bd171d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ac1a9eb72e9800c83cec67c00eee993

SHA1
af454c51055387fd2b833509880e9fac497c5a4c

SHA256
bf14dae54e9d31d58575f1bd99d6a45957bbcc2e68a0905d22f2405b102acba3

SHA512
96d3c4e7bd1544096d34428448373340e001e3c34869aff18d5a4d09edcf064fb4ea5c61ada8bbfcf4878e52f5e6dd1e93309cf6aa6da1a03f1f99774b92c73e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7915ba0545666aa5833cf9f9f86d45d6

SHA1
743ecc319bc2a54973582d4a5198042a48fbe8db

SHA256
f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20

SHA512
a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f452c04363d88c59fe8c965f538c1f91

SHA1
98b2fd7d4f5ad1c0ec46b21272a143a8bce6307f

SHA256
628c2fea3108e50a66e12538b4664166bdf988acb6f7bcda4569299f9553031a

SHA512
fb418ef7cf7850ba02b66b43bf5a9cc4eec76b2da450da88a6783081e6db5f0e3263345003c8782fd1a3ec1383e67e55abd386dbcf6d64b95e5da8022aa19017

Download Submit