53c25528119acfca6418d4eadee6c5d6fbb13b3e974b278cc7a2da7f55dd8397

Analysis

max time kernel
146s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcd0d161b74655920001dc904e922bb1_JaffaCakes118.html
Size

58KB
MD5

dcd0d161b74655920001dc904e922bb1
SHA1

4274e02dcd878afd39729f84a5661e9b8a643ff9
SHA256

53c25528119acfca6418d4eadee6c5d6fbb13b3e974b278cc7a2da7f55dd8397
SHA512

328e9adf0d46192844afe09a1ba569030a3627767f13a6530923a8b1059a6c01c6ca5d302a4582bf82247a3f5e4901be961908a877f3f9ac2f93712b3bf732be
SSDEEP

1536:i7ZZ3PYzRIJQL1iF+EewhXc8Kq9VgEgIKgFpVXnYJWly+2MWHVJJg8vqrhj/y99X:iXARInQwW09VxpVXnYQm3Jg8vqrhM9X

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
2684	msedge.exe
2684	msedge.exe
916	identity_helper.exe
916	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3464	2684	msedge.exe	83
PID 2684 wrote to memory of 3464	2684	msedge.exe	83
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 2060	2684	msedge.exe	84
PID 2684 wrote to memory of 4052	2684	msedge.exe	85
PID 2684 wrote to memory of 4052	2684	msedge.exe	85
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86
PID 2684 wrote to memory of 3700	2684	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dcd0d161b74655920001dc904e922bb1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadbad46f8,0x7ffadbad4708,0x7ffadbad4718
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14097800747057123384,17321323539790902872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
616fef013ece98dc71f9bc5b05386a9e

SHA1
c576d3b1d5720ae02b70b950b58375cb425b92e4

SHA256
ae8fbc10eae34bc1128892636a0addd6c7dffe7b3f386a299b0a655dceb829e3

SHA512
4d0fb3601a833fee44d951517b8b43ffd70d733247573a26153268251ab85e0c2b7896b0c7e738f82f18d010f50fa1a7927f6487383d3c204baf1ca52ed864fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e338cfa3ed1e19c66a259581049be94e

SHA1
7fa0aa6ad433dce409f42ad21e51313447af3180

SHA256
2ef35d70ecdd99180a26c727f44e5f16cb1d4abfeae3cc9423034f5bc39f21c6

SHA512
4d8b15dcf06d4b118f81c8f0ac8824c07094235136b1e261dcb481c25c0e4e37f22dfaefdd43d76dbdeb2036f8a9b3c460552cd04c958b3a5b99a3a63e6d1eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
61a5be1b5ab71241e6f62bbb2a4ee050

SHA1
38e94fa55f4d98b6381ab66ce3f7abbc7ba872f4

SHA256
8c34efa0d7d502ccbc53c5cea955ca7f110ef3e8d2d6036c319c0457908de9c5

SHA512
87873cdbec665677111dfd726744688fe7e940455f2b4defd0b11184810045b021d6cf886d346b3c4d7da0994b2ab0cf62b62c2b8777105b13a868468f0e8a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
629db5ff813aca6f8a66a0953cb71010

SHA1
af91d93f6278e5d67bd2dd220cd4e224c1fcad32

SHA256
b7f98d6b52fbd8b84169369c861ab87e0336da26d6f6fb49b5cdc63a6fe5184b

SHA512
77e4710b430401e7854d7bba0297dfc43fc8cac630373edc348d4cb189ba0dc2ce2d3d973bdce28b7bb4c96110e609caeec3ae1a602b7ec2b1b4f43bfe19fc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59db8e55a7c58a37364d936668690b3a

SHA1
70c5934578a3269f5743f5aedec86e5959ce2e30

SHA256
2692bc62ae03033deaee638712ec770da8763303ce5beb5219b1192bd6563a6e

SHA512
f408ab70e09ae03933ee3ac9c08010836ef7a176f66adfd1fe3d15a5f55a5e91be05469da5c7b3e90b8ef41325cb2b99a11da5446c064e74c96313f7ab68832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9664271ee5c76b0511b8f3eba67f1165

SHA1
40508f2e57113c7f8267d1869fab5f70bc5991c3

SHA256
0be66f3129fabd8691f03068d1081f35ea73005947155a14fa801b47fdd1f601

SHA512
996dea05787245e1140387abd156114ecac3af23e85fd2cb3e3fc7a0e712c73a85222b649bce14858d6d739189a6e5f672e28602ced49740ad85a6192df00c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2279a88f0030724bdfb9e2159520f68d

SHA1
456ac589d79c39f18b91cbe7c6ea12b4f779bdfd

SHA256
d0ed3608069de13844f593bfd26823e35d5f67e88ed2b364969c97a30a75db44

SHA512
e8c2921bf96e29262f91304b96807bc11e4f9332045a7268be67238b86f134fb5afd9e06f24d76a6f86a0bad000a4444e37130c42f6fdef3c32c6da9bfc126f3

Download Submit