8576e01528d9d6e03f2d1c72b6558640f3f30580dbcab7e43e5a970457adfee2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e02d873bd2b0159e1166e722e20d71c8_JaffaCakes118.html
Size

60KB
MD5

e02d873bd2b0159e1166e722e20d71c8
SHA1

729880047764149b0245ffead900a3c61ad4cb57
SHA256

8576e01528d9d6e03f2d1c72b6558640f3f30580dbcab7e43e5a970457adfee2
SHA512

79323a3ec6a25ef761f94bb73f2f05da672a753a0f3370aad23ad69ddf4e15eafd0395130489707e887e7cea2ca1165fb14c97ade8f019103ae34e3ab16a6ce0
SSDEEP

768:6UPBzOBplNouG3+bH9ncS20JyjYMqxkqdU8lUTzFXvdrtl7oO/sNNHBRDiSvczuQ:6816wkR8jvqOg3WT5xoO/srDREzl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
1800	msedge.exe
1800	msedge.exe
3456	identity_helper.exe
3456	identity_helper.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2516	1800	msedge.exe	83
PID 1800 wrote to memory of 2516	1800	msedge.exe	83
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 3324	1800	msedge.exe	84
PID 1800 wrote to memory of 4820	1800	msedge.exe	85
PID 1800 wrote to memory of 4820	1800	msedge.exe	85
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86
PID 1800 wrote to memory of 3284	1800	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e02d873bd2b0159e1166e722e20d71c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f3646f8,0x7ff80f364708,0x7ff80f364718
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9772345763025110953,10615858680336009505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
e4cf8355ce17f18d6d51d8837901a752

SHA1
b8ca69abe1970aa8d1d3ab31bfc3e1cc67810c87

SHA256
23fe1ef762c4de7888420277701087e2623686e1e92540f10ed57806f49b4932

SHA512
6169b57c6944fae0c56ab496137e50c093c0a2d6b1deb058cc9bdaaff1872d4c250b94fb4def84995c50130c1406d7a6101f560d5fd03a168f925e746de2e132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
72de253f8a7b48a7df17e8f8d595f82a

SHA1
e18162ce8bada8c9d8a7d99ad0d05555ec2e4309

SHA256
59545f41d233522489b429b9fddf6318de4d6812c79165fa10439e1c5ea3d2d0

SHA512
98f375f57384279ba0884d019edce977bb8087b47955740c12f1fd2165741061b40894235bd6137696e1b5828d30d754ad6ddd800d845844ec0a31d92a6b0ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b646c00f9327da759a1e183e7e3351bf

SHA1
06cd3fcfd3a05d26752b246beda49beb7a7aaeec

SHA256
b8ba8929e70937f4f27bb14c3ace83c7d1d5abbf538f493ec8ac7afb3539a61d

SHA512
859b56e942e34f8868c4a76b00e5aa1ee1a7273a1cf2d83805492bab4a9c4054f83a2ce604a986622fcbcfa3c7cda2ba31bb6ed174891d2139b21929cdf1072d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a6fd131ef6be0345edc79691c5f9845e

SHA1
d525843970ee6c5b0d3e869463c8b35938b75cef

SHA256
0ced6bfaaaecd0c28de4d43113b61d7181a87bd1fb6d3104c1e85a6fe76aa50d

SHA512
7c65d216a12b6a04d59a44ed8281ee81d58f4b95a026c38c99d3dde2d36bda6670d9d14d048dc5cf3052bc857893714e5173e95a610a8462ddeef05f4f15b49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
96e58722a803eaedf7225ab60575f2d1

SHA1
3c0bf61e94c6957e969b222c7b7a3ab7989c7003

SHA256
8c46b382526513b0d94d56b1c06de7519bbd5580397f64b29e6f2beedb3b4703

SHA512
dbc92301f6ffd620eaffbf2a4548172b7fcbb1ba42a5220bdde370503fd97f601bea9928a40e4abdd669a4fdfb6811ab252628b7370ff9e538b34f47d2724e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b4e63109b4ea5c978bab16c8f761643

SHA1
0d470eb577b8af7d5e7bca882eb9e33d00e795e4

SHA256
ffa3becaaaafeb330321b00a6f1c02d2484bd8155522020c1e8b70cf913b3051

SHA512
b19c4d84f62c1eca713d1147f6027060af0f704e319ee35136eb8f1786c53a7747fb1f37b4fc4b15bc2a494f183a3ddc18cab77074a2b83ea2ade2a33306d12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dbf8de4529d0726ee76733a15a2e5f19

SHA1
05390ddcb2c6b9bf9e18075ce7f2db6fceab832a

SHA256
6f3dc3c747f1f01370984df32a93b73711e0411f58de62270fd981ea9472c739

SHA512
d4086cb73c14882d2986c4971bd66cda3d6014873a7e35868fc378da767a1ab177d2e20237fc63e97d631e16925f841f2320b7baa1df5ff9ccca7ca6368371f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d678d1ba8ff54de9d3bbde99aa037e77

SHA1
56eeab1a929afdca9b4c98492369392ae8be73ba

SHA256
d02578346be728455aeccd27a9f1dbff623ef08dcbb16475ef5fc1a21d948c1a

SHA512
1293a9aa753871a69de1f81f900a693d2e48a985f75e0315e62d3b293bc969ece10d86468107ed667652aa828771a8183785d33fadcfaf3efac410a17ccc1b74

Download Submit