f9957860d7223549effb4534e220a7139be6acc61664b17b3c08e0833ae26652

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 05:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ddc04732bba350e9e34c8492a138d580_JaffaCakes118.html
Size

122KB
MD5

ddc04732bba350e9e34c8492a138d580
SHA1

317725ed543ca1f329d92f1b5a641c794e75f9a5
SHA256

f9957860d7223549effb4534e220a7139be6acc61664b17b3c08e0833ae26652
SHA512

ea9bf2b5b7ab70f1171df9697deabe44dfdaaa025308d95365353d60900a3b8b934e3eb5aa4fbbd7a479635245fe7d2cb0ec4c1b3ed6a6ffb750b5e145a9c460
SSDEEP

3072:fV2ALzeHRM7NLIpSf9P9Qp/9u667fZb7hUWloczB56jo:f+a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
852	msedge.exe
852	msedge.exe
2220	identity_helper.exe
2220	identity_helper.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 520	852	msedge.exe	83
PID 852 wrote to memory of 520	852	msedge.exe	83
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 3472	852	msedge.exe	84
PID 852 wrote to memory of 2908	852	msedge.exe	85
PID 852 wrote to memory of 2908	852	msedge.exe	85
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86
PID 852 wrote to memory of 2388	852	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ddc04732bba350e9e34c8492a138d580_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffae1746f8,0x7fffae174708,0x7fffae174718
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,8394111053750885204,10205790836032158792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
082cde920884d87c3c424a39fd397061

SHA1
a2689140c0defa98a8918cf76a43defc35d13f52

SHA256
0688db63d0cb75d30c9d7d0fbc8ab52cc31c08082d4f9a84c653b47a72ca2bc8

SHA512
40b7908ec93b19f64a53ab2ca173b0b04e34837d9196e37f21129b354f4b304cfa6a9916425c3a647321e28f2ff633f28adc321d5739b216435d2668603e141f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3a27839ed258bb1794d1bc5395d6bd9d

SHA1
5e25076a0c25be9402526303e15c51857a478574

SHA256
08b9a804e79ffe575093632a371979e189cecccd0cb4f387ab6276e745c7cf58

SHA512
7feda1b647ce14895ccfee2231d9590316e494f89b1e08d555111d275b2bf9fdd9c7c26c8604d8405bd2537d136fde1e5609291fae1e362091fd5f7ea9163e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
57ab63ec5c806505701ca280d02274d6

SHA1
0f34a2afeb4c224502f049a6851f8a5ae6e9840e

SHA256
fed6fc5c18d058af5a9b9055c0def28e93fff9a4d54b5a5f109f6906245924dc

SHA512
e82a0f846d459845c3d62b2f99b48952f5546f4ec9b4d331f883d15744f3e8975c343ac4720b3f0755654cd50ec718bbf3377b9c488ad9ba593a06c6c032b214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f8c731f93e84fc1a9d0c48c0f4489556

SHA1
0ee5337a2291786f23b64c8a91615abc7cf0772c

SHA256
59625f2d882f827a2fd113addf93bc91da135bea581acc44bff6996f868dd133

SHA512
f4e826dcb6c220d4b07f9c8814c8f3c955ac78046082240db5ceea9d8034e5576544f349479d1aa35630fbd60bb3252023886f41ba329615af1a1e8af413310b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8e4379bcf9599a956cbde2d8c6b9eab0

SHA1
9c55aa514ff36c09c48345e04192a1015c53e8ce

SHA256
4b39adae6f9e1717711f8d5577cf7223f0967dcfb68e3f8359af68db0e478f5b

SHA512
a6cde745a6feafc3bbac764642be9f56ee708a860b3d9adafe56a5d07e9fafe7a0ad96c9c5c6a14959b1c834302e4840a196c0b4680a586b9d69552b79a57426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ed067595c4cd4c1ce035e55675d19ec

SHA1
761bf50eb6b114edc6fd85ef3e20c4d317f6a856

SHA256
94a1a84c7027c6d2f9e17d5701d43cb2bc5fdbb1b06053b06b3dbb40c06569cc

SHA512
01d63f64538e68adc00d916662be48b5817633e72beee112fd6a4e3445236e4e9ca32565538919a1e69901ced4403f018e06d1d23988989906762d7ff94a8d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03250833a41e87d56167a9a05a2cf055

SHA1
c33ac506f5970a9fb026f20fd9750071e268a7b4

SHA256
363cf9eb76686785d9d593dede405ad850a53d5204765c08b3c5124e12359cd1

SHA512
da4e2ad2f0a41db86699fbd9018269c2041fcfba0cb2a1b440bc800740aa8f8575605e65f6bdef79fb705dd374421f2e5f5c519c48c4d87545e2869a415459e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5e4906880c1e0808a8ace267cd19cf7

SHA1
eda6d93877a154a5d965e9a2fb3c823c9a46af98

SHA256
75775ab64bcf8063cc84984e93c5c47c7ac3bee0fb8b5ae315ac8f48f46230bf

SHA512
0f313ce40bbe6a58431118f062137ab4e7bcd71e47a03aa69dcf4f02b0e07e56206ba7c12cd23d01ad7f8589eec9df8beb75e8375c068560642fc0318ede36c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
74e4f63bf4f96f8b9b69ddeceb38eb8e

SHA1
a616e05dead4338deb8d3aa5df1d7cb0f392ac93

SHA256
45f8e189eb3285171a355b6c6dfb1fbf00edf379254ec7a5308b6296129e2a7e

SHA512
bbe8bf9dbfab0ce4fb0847a3ec5baa04907aa742785100b8ade666f95fc41920766406a213f9a6b7cdc82316d2ba07999e29e03055c08d6cdaa5578f1293267f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4444cd72d5fd6244fbe5ae834878eed9

SHA1
4ce1e5774e992635c91aeb141d7f64791ce729ef

SHA256
f89ef9d4b7537aedabdb4f223594f78cd9355b5a3968301d3b1e19b0e4e6697d

SHA512
ebc991c474fde576dfab50286b470ecd8c5de691c9404ac2e99af4540333a7bf98f9953584d6945f96e17d9451a80d215270cec3cb871d2da8e4f41174a6c414

Download Submit