8e2c960d126ea6b03c78de19c359c14c5df03d896aa4fe8cd84ec481caee130c

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d519108e1be3d2c0e95ad03c544a08bc_JaffaCakes118.html
Size

175KB
MD5

d519108e1be3d2c0e95ad03c544a08bc
SHA1

36c3f437c4c8904ea05bc86998fd200d35f232cf
SHA256

8e2c960d126ea6b03c78de19c359c14c5df03d896aa4fe8cd84ec481caee130c
SHA512

3b6377873040c83e407933a4637d76a219d92e30f3f2cbb07f9a4db5ecac9b72ff741e2cbc5269c3c6cda8fc4c816903d2bc18ee879927bf4b7faa423b900dc3
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3PGNkFsYfBCJisY+aeTH+WK/Lf1/hmnVSV:SOoT3P/FJBCJiSm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
4284	msedge.exe
4284	msedge.exe
1500	identity_helper.exe
1500	identity_helper.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 388	4284	msedge.exe	84
PID 4284 wrote to memory of 388	4284	msedge.exe	84
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1272	4284	msedge.exe	85
PID 4284 wrote to memory of 1516	4284	msedge.exe	86
PID 4284 wrote to memory of 1516	4284	msedge.exe	86
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87
PID 4284 wrote to memory of 1168	4284	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d519108e1be3d2c0e95ad03c544a08bc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ff8b22a46f8,0x7ff8b22a4708,0x7ff8b22a4718
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14204577520998486562,15121811152685595233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2644 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
20KB

MD5
715c79e5f50f4530260c4456cd414d72

SHA1
b8f156341cdef9b668d4a820b06fbb1e4eb48584

SHA256
d1918937db9a519cacc80b9ee812eaeebffee72782dcf7a189022909046164f2

SHA512
8fee1f9df28e7ec04a63bc85f5e7988fc1de0c94b905c58277ef00bfaf645e3f7359d9405bd726e420cebe898b687335e6d36e17a5c740aa774e9e3d249dfef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
b9dd35106a63499ff040ec60d7a75861

SHA1
9097407e1db7627855cc3b013f412398710b802b

SHA256
3e2b6de134a2c96d203fb8aaa8ef12e22f0f5548ab004f6543cfd7f0ffa17082

SHA512
5c430f15b70c0bc747bf1248d31506b778ae95968f1fba64b1f1f5d59cc3640d52e4ae2e006fbb7d68f89d02afaa8ff7d4921a3182d4459d7e6d2dcef12ec66f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c699d4611e36476620583809671a875d

SHA1
685766f4664cbfc05ca248c5a2865151e4f8d4f9

SHA256
c062452828d02ebeb50d5d72d17635010e3d3de547aeb99fd6be41d9a6a3f1f5

SHA512
a092134fd96022ce2e87b89e0adc8be71f1cc787f4950e6fb32ec46101d27c4ea37fe331f743f759e3ff99f40c0652b79056d1a21e5324a6624a20d381c9a1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2449994d26d1cdc3cbc0dd0624593929

SHA1
c9f236c9536a273a90f7180fb5decd987f1f4a1e

SHA256
af737778a7f4ce6a33f65cb149d7f838ef002efd1639c82eff679ccc98d6f3de

SHA512
15c9319a701801a90a507934071d0e92b82646a4d06e5d09f1ee461d715b9f35ecd6df3f4e2534cf42957d4ba4a040a915391b821916c80d6db15fde55ff595f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8124d2ef12a7a5b7babe8f572e08fe52

SHA1
69bd76581b5cc3265bb6255f10bb70a94fe2efec

SHA256
f28183e16c25ae0cdbd0f64a176b2bfc6d387c0a2d7d5ea32c249c5b5ab9884e

SHA512
0090a7388693691d351534db2d352047108bb517e8fc2990ec6d5b9b911944effcaf7205892b23769ac6db412c2fba9a5e4f351def47b5ecf1d0616f853f7b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9d23c35dbddd986f8ce3d28b2e882fec

SHA1
5c5dcdb371d897670dfa20775836d663292f86a3

SHA256
ce139e5489b6c56dd213e7ab2d7b8cd73d14359b1334e084e2c55cd8316838d2

SHA512
cacc642c5059665afc2b2431a88d25a993bcdc32afa3c6d286894f731cc56fa8b6b889c7ce0343399e6f610a7d22afa15dad653915f67c55efd72bd8461af74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a446c9d2a52ec499e6df1c7e56343d92

SHA1
2e02f0d2233b7c7fa0c2bec50cf48d2c47709622

SHA256
b1c9ac732579b63918819e776dd7ba6fcdd8be13162b6e101751fcce6d96202d

SHA512
ead4161916fcbae17d2fe1a37f4e7b9e9c780d82e4e547f9c3bcb0ecadbb8cd3c96de6d29b31887857621634b3a9c60865cbeb843854433c0824d80dff64fd9a

Download Submit