4e409ce11213213519d326a4986ce384809a8e864bdfd38e23ca30292c281532

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e23df6dab03a073a6a2b3bbd517b6cdc_JaffaCakes118.html
Size

158KB
MD5

e23df6dab03a073a6a2b3bbd517b6cdc
SHA1

c3020c46179e089ce938e7eea565faa0f26a50f8
SHA256

4e409ce11213213519d326a4986ce384809a8e864bdfd38e23ca30292c281532
SHA512

c9bcd32c7db1f1168ac3b98b15dc92d972e8c6da9dfaaf896b35d8985ba3a21ed008b7b1d43f2d4d8f0e8c8f765c3f3d3e4f9076ad1db9b8ce003591a352ac53
SSDEEP

3072:YOvUcjvG8rMUcXmNRS7rRQFHZc9PfV85PNW88ag96T:TGXmNREgc9Pf4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
4624	msedge.exe
4624	msedge.exe
2924	identity_helper.exe
2924	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1860	4624	msedge.exe	83
PID 4624 wrote to memory of 1860	4624	msedge.exe	83
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 1404	4624	msedge.exe	84
PID 4624 wrote to memory of 756	4624	msedge.exe	85
PID 4624 wrote to memory of 756	4624	msedge.exe	85
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86
PID 4624 wrote to memory of 3168	4624	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e23df6dab03a073a6a2b3bbd517b6cdc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfad146f8,0x7ffdfad14708,0x7ffdfad14718
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18275606417410888833,9601706699882962336,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
24KB

MD5
d1c8fc93e329cfdb4cef6b1363e40db2

SHA1
2d034d8d0056a8c1596714c7129fc31c74a2565c

SHA256
facc5d448f6e3267100a4c236f09aa98bea1cc3b19e2b2a0985501ca499c4ca2

SHA512
07434e4af30064d5f67158d10b704afccaa31f974ccaca5e76dc9f1b05d76106b44f124c3a94af93eb1b44a5aeaa70ebc33e0f9f904d1cd4c8386b281735d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
89c213dc57998b555e7476b1ac014b87

SHA1
5b4da5abd00ba33eaf8219432c976e5e1f86bbf4

SHA256
48a0297765d02a00e816c04edf3d6b94b03051b6decdce2a933d3c0473de76b8

SHA512
1d55334dd332b4f0a6f4f8a0dc8fec323a67bca62edd55cf7539dcf358ff8b39f02642a6164bf5fc905f8a4dcca590394216ac11f040ff91af59c3a4906ce56b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
73da6ee9296753c302ae07aa7bae1dd4

SHA1
9faa36bd50c9c8d69f1bc56f7a8e487234f3ffc8

SHA256
96053f2f61315c46a7f5b072f248469dbee434f6cd78b1534c0bd56729292e32

SHA512
159cf46868737b1f7cd00dda9df877507767a41a34b0493d76b9ee237b5966d369f50dea2060744c4ccac9ffeab1bdab980cf795f7377c05bbc95baa3f11c94a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
862ef37edc4dde980a52732c16910481

SHA1
c8ba8808946138e43973dab0559d056c63a8ee93

SHA256
51ad80dc1b160a6022b65d9c19405876d61f7a1b151a9120c29d246fc90b9f10

SHA512
dec4f27f9ce2479a7d12af1f8720645c261cd399634923de3cac54a0f727904e6559c8b5e566e63c0185e1c13fe8d5cdb2ed84d07e585ff9411cf224d3c0071a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d81a12288679cef0047ca8999c91f6e0

SHA1
b03e04d7dfe42f7b43586617f9813603c6c33973

SHA256
a8e61c37660ee15bfd1d7d57737db1d0a389166d3114ef7fe914eb2ae6ffa099

SHA512
716944e3b10806ff804a58c59c8190e6e421c387709866c24cfb0c463160965d77a427a5a251a999f7daabcd31baf589ffa3cb29eb1853deeed089f44c972a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be91718590e898b7744c15bdbc7df482

SHA1
584acd31b59e8de17a59973c9a894130d8b58405

SHA256
ed09f31943c873d92bca07dca7abe0db518a3190409d0e648031c7d759ff149d

SHA512
1b39ffe4893c19bbc0f95c51ec79b5a872ea2822b137356ad8c1a3f95fb470c6dd1f6555dbc81e98be6dc3ab1aad017e2d33f774b2911737224cbd2014d40917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4463e20cf76f89ef4644e93869936611

SHA1
23b6f1ef439b5f7fb4260513cca4128690628dc7

SHA256
ee8aa4d3ec38472e698715513632295ce6b87c4f91246169a8c6fa06cac41615

SHA512
4a4b22d5ffb6d767406e80f4be23dafbc98c756ab48e496fc63067611e24f223035a684189453727715897bef20a9986f5f8cd39cf126c76bc4210409a941f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
690f61dd47b512b1c7313b6645535346

SHA1
8675c8d052595fa77a798d75f0f630f1d320cb95

SHA256
40994f6c2cf7a2fbbf4d55637f657eef9c1bd2e0cf7c0bf2da49c4781c4e7c35

SHA512
9b98b127b3882faf54bb77553619b2a9d9a93a2bc2919c6d9b0b6dc915627b09f7150a908bc335af0fd886adbe7294524b9cc7e85718d7546144806ab49ce1ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
352c86ab0927759159e721acaba0e32b

SHA1
fe507f2f4bb1456ed3c91bab7d2c42c0f3bb84a5

SHA256
e775815635387fab922aace6149bd7e236e41ff080024abc5c1d459cee03054f

SHA512
0e02a95f0180712256d7d237ba645a009bca0051b444931e870311c2d1be1aba431d708b5127ff273760c7b6c2cf3affce4a9cda93778e8c3b86acb906fe68cb

Download Submit