c570bc7e068bbb6ba872c5830464d615cc5ce7393c4eed3fbd3ad2a7799d52df

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d442be2e02832ee4064ee5529d7d41e6_JaffaCakes118.html
Size

190KB
MD5

d442be2e02832ee4064ee5529d7d41e6
SHA1

383866f43b99aed3209acc7f23f71df7e14b00bf
SHA256

c570bc7e068bbb6ba872c5830464d615cc5ce7393c4eed3fbd3ad2a7799d52df
SHA512

82cdb823d1e5db8d0dbd20af5c83f7d68f9f81532738c054b08e9280409849af20933c159bd374e5b06aeb0997396b48a5bd01215637fe18fbdf446456f26975
SSDEEP

3072:B8k6OXTXPTluZVQorV044NlgXXPTluZVQorV044Nl1R36vHigNrwQhZnFAv9tXpX:z6O3luZV5rVQWluZV5rVQ8NjhZ0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
4404	msedge.exe
4404	msedge.exe
748	identity_helper.exe
748	identity_helper.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 436	4404	msedge.exe	82
PID 4404 wrote to memory of 436	4404	msedge.exe	82
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 4248	4404	msedge.exe	83
PID 4404 wrote to memory of 1096	4404	msedge.exe	84
PID 4404 wrote to memory of 1096	4404	msedge.exe	84
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85
PID 4404 wrote to memory of 744	4404	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d442be2e02832ee4064ee5529d7d41e6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe024c46f8,0x7ffe024c4708,0x7ffe024c4718
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6582226217636414686,11723598883800051423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
4f16f03db1e1b3caad081fc1cb85cfeb

SHA1
2ffa872822aa803307b225abd8b516a38975a8e4

SHA256
41aac9fc41d92bc10f501ab9e1a6cfc556576bc93cd47f74d6ba58a2eb5eaef8

SHA512
3e5f305aea0af2e2c0f1b915ea4962ddb75053b28ab100e78d8dc983c12b5f0cd0e1c51d470e6d731d40a39c7fa3bef0c134d19961edf864c83df629f07c9aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2157dd675d17e750bf79d6f29d8c55dc

SHA1
b4781672bb450e4edbe9c0729521475bc47e002c

SHA256
740d905c4b22fd77efcb629fc3a17164f575077672e4bde8b3515b0376779494

SHA512
e2cc70d1884eb7df6d82cc987a30dcd0198ed7874eb5bfdf71e2dc9b0409ae31eb872260639025a0f8b54d0663098c9fa74849a66d8a290d74e92739f34e54e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dbfb8fcb35a81ce51f20d036ca35e11b

SHA1
94d2bb6a0ddcba6ae5113fd72c0bd00ecf9e53d3

SHA256
c8fdbd7282863a1fd81652834d33666726b81c16c966b36a059f02a2f41b60f5

SHA512
8364ddf21cdc235b7a2625316ed2ae3520015edebec879550fb75c248b10817a75a36d81051c10bededfc6b85c0b367a4f65f52a6bed1ec966fb9a748eacdc3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1bbe8ee90c2f7d240de97e37bab97c1e

SHA1
d0e75280c73153113946fcc344f57caacfa08c26

SHA256
13f1ed7f62ab64d1c82f54ee60155c422a672dea2685eb5383f9ee7845d9024f

SHA512
655198549d41da86faad0ad05a316075e9e69db7c3093cf7692933be4241d033a49f3d7dff49a74af8ce041b0049d19a58383c82e50a6c5533bce27ff811e4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f54719482fd0206bb2e8b70c77362fc7

SHA1
3ff21e3e53ef4931ff991f84e1effa83db9ce396

SHA256
0b9689c3692df8c16420146d7d4340623d759dcc6124574f3b69e79fa90117b7

SHA512
4f89cff7f2a26883afa4747d86196c13ea2201b46d8955aed735952be5c4e98a0a818fb767327293b827e7faf86c80dcdc3da642132e1524203e8af77054a2e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10d2502da223e0342a0092476a62f4ec

SHA1
09cedef03dd9fbd9e531d7772a2fe3f6669d1a93

SHA256
637693fb4e789879a9ddfc39583cb6c55927cd49f5094b04af9c8176ad71176b

SHA512
233afff5a033d8ce73667b488bc7fd29ee36df903e59724fe573d5f7eb2bfe8e228e11f8688fbd771481419667c6ef4d4ab68c592dc69a168e24d359659ae065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8adf830300781e381332bb54e54aba8

SHA1
188b54f0605a312c4c252efd28716e6e5737f31a

SHA256
4593fdfcb89bf79c6dd30c5a8fd50e1efdc02730f454402354b10a0d0af4dc97

SHA512
316db48ad3ac211e335a83f41ff9323304082ab82a16c45b546d435c4cd7537c13a0bbe34681de07a25d750598fd6ceab426946d1dc78e95ddc85d2e91132a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e7203192-a6fd-44f6-a8ea-55353c4d23d0.tmp

Filesize
5KB

MD5
337f3aed0ff8f09c40e69a6ecfd61d04

SHA1
c60300b4be4bb8aaa4d4ab28fbe12179489fec97

SHA256
2e3c9b377ab55bfdcbac783b8019be4affa2125f3b120ba873e8229700733822

SHA512
e28aeea95d084ddb44b3b3b3e17cb2b8cb6f06ee927f35b95cf80a971dfd70de698b88e3337c19dc5b64ad7bcb81586d682fffcac966ae2c20e53c7d7a3c6d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2908b7a0e573c1314e316614a46c4ddd

SHA1
70d1bb5f5c47a3c4b352e1405cc1958f80a98038

SHA256
e41b335be4be3286b4f3bb4525696e26ddd4ad6a7645da667e2f57e714180bc4

SHA512
be641c679ca78646457f551e1f0687bf01026faaa097b128843dce1c841c82bc5d223111bb443f1497e90189d3ccbeb7140127c985a867b375e75e95d6fd697f

Download Submit