f314980d6cc6fea302111be72fbb1fc917b7ab6095d11290d15f0eb9bf3b3056

Analysis

max time kernel
147s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e241dfde35a15d00519ab58206de7a65_JaffaCakes118.html
Size

208KB
MD5

e241dfde35a15d00519ab58206de7a65
SHA1

b35836c57556e5cb8493700ef3ce0e8b25a0f28d
SHA256

f314980d6cc6fea302111be72fbb1fc917b7ab6095d11290d15f0eb9bf3b3056
SHA512

5d73ad1280519a460d6ae6c0698d0ab9a9db3a56aa7b86aa586e8d3d6bb2c87e8094b61a4a4ddcc275c773062fa1bfdc6b6097fc333a837285165e44aee543e8
SSDEEP

1536:G394zYaKmkMVtoKBnrAPa4LRHlDAoyIs62jWZw7E3C:c9AYaKatoVTHs62jWZw7ES

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1012	msedge.exe
1012	msedge.exe
1892	identity_helper.exe
1892	identity_helper.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4104	1012	msedge.exe	83
PID 1012 wrote to memory of 4104	1012	msedge.exe	83
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 3420	1012	msedge.exe	84
PID 1012 wrote to memory of 1200	1012	msedge.exe	85
PID 1012 wrote to memory of 1200	1012	msedge.exe	85
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86
PID 1012 wrote to memory of 2608	1012	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e241dfde35a15d00519ab58206de7a65_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8231546f8,0x7ff823154708,0x7ff823154718
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6633815042865541467,16529946608206754166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4829218222c8bedb9ffe89dffd37095

SHA1
aae577f33f413ec3d09f2e7ff5d9cc20a602241c

SHA256
49239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b

SHA512
03e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
15e9c4b4eefb3e1c08a010e748e10f58

SHA1
3172378f2c7a00553ce086dbf53fcf3126c5a724

SHA256
07b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000

SHA512
811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a02d669c86965208b764f38f963db3c1

SHA1
43836939e199f02a98742a72cfe6ac1a530a70cf

SHA256
9f4463530a5cf65afc7fccb22a87062f558d179b896dcec18605ec368462b23b

SHA512
02dc7a741575c9a77201189c73e0272b110eb793e16badee4a1f809da18f9b87ce30a388442bef00a66def07065b739ec9eda9ad8e5c2f9fd0c6f3272054f827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2061207d7739ea2a29d471621815a135

SHA1
7bd4dd78d9f0a6de96b9c6288a97b0006f1df57e

SHA256
a4df51ae2665bc54940fc3b4dcb874130d94d3fb9de9991b739376e1fb2b11fa

SHA512
5de3f7470371c643a56aaa073cd564d2962b8350ad4c8b5b181b595fad02d5b8ef6400ae60ea13922f3756fbe42912c0ac721f1c554f27f5ca69fc31467fbc7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
35f6bb6baf43e1112f90d3a2f7c63cfa

SHA1
11be9c1b9e0e4fcd8b57be9555aae53d7508229a

SHA256
db970e3a32ac723d6bdc4ca41fe2a31692d8c5098db826edf3ac7ba4163dc353

SHA512
1dec2c4e70aa491dce20d80f2b93988e9906c9801f98b6ea84eb33c4432abeda75f3f57af7a83b521ad905711d46fc492108605aad97e3a610094b5c6186b668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3bab007fd7c8f04794fb68ec5942afc

SHA1
9ba8d63985785de3e4134f05d21d327eac431d09

SHA256
b24cbd03d315f678c3740947110b891608d3120b99f7adb1d8410241579da09e

SHA512
7a343dfa7be3b096d4be5652614eb72da485651cad99245b732cdde9b83f1e2687ddd4c137c195264d64963346acbdb0d5553fbd6f11bd86c4fb9dd1a364abe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21d29aff70604470880b6651675f1070

SHA1
f3c26e6fa4ada6bdcf9328797b0ca4b4341be4e5

SHA256
21c1eb89ab11f558e814afcdb3a87b8656db260954cf36dc13a86bfbc95ecf00

SHA512
d6310c57707451e5f83f8665a1c3a890df7c39fd8e1ba6967e0e0a1eb17c84fe4c2b042f96199df8ae6116875744d48670af65d0ac04e2aaa8fd0cc201f39686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
62be17f4307c0adc29dc6ecb06c780c7

SHA1
415df3bb6598bf1d91501f7bd53cf4db354d4177

SHA256
8d81a04c4a3e878fd4a763d31f815e5a79aec8fe0d8c5aedf3501d5a2aee4dc3

SHA512
46a46d33bd8cde8d9c72ddc9e358ffeecc9b897161c5c2c3c89c85137591c8e952a675930b04b7ef80081365bdfc5b63f004fafae8c242b768ccac8c24eab64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ff62f534c6ff24c5ba14852ccf41715

SHA1
52b96b5fd359cfc198be9b552ad229fe51b410ef

SHA256
4bfeba7e62b2b4665bf832fc64a6a2fb8d5bba99982dc55bf7ba5bd90af0f3a7

SHA512
a10fd2d9b65fe79f9fae21625dbbb79d784d66f6c898beeaf868b44dadbdbf2849f5a2a4485b300e70628532111a78cfbcf58dca686c93cd0ebffb1b25a4a797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7915ba0545666aa5833cf9f9f86d45d6

SHA1
743ecc319bc2a54973582d4a5198042a48fbe8db

SHA256
f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20

SHA512
a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf5ca9bb6f9ecf30a96e2927aafe2ad5

SHA1
63a299448ea931c0ddb9a842d4737c70d039152d

SHA256
18b083cbe0ad4d30b4f7c84e829b0367f01f2861025caa4d464e937c558e0a13

SHA512
8ad2225fb3b8082c54f96fe0681164446d162e7d82655ab534d25b6389593130f0b72d84933aacbbdc931aa439c3c62796d1dc911dad96f9586aead1dcbe88fd

Download Submit