13be1417d3f2e96fe0d4cf65939c2d668c1f2efce2a96320954f28a58a3f8044

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac0a76c1252fcfb830cd598e5604012_JaffaCakes118.html
Size

97KB
MD5

eac0a76c1252fcfb830cd598e5604012
SHA1

ce309f55ce90a3045ff7ce0273c89c7e874a5bc2
SHA256

13be1417d3f2e96fe0d4cf65939c2d668c1f2efce2a96320954f28a58a3f8044
SHA512

5af290ac56333c01bde2f5dddcdc9b6a759418aa7fe05f6e6dc9a09ab6887e5578e8929929b64dd76e01a2bef3fbcc29f07ca3ab678d1d1e30faea58a0f64e8a
SSDEEP

1536:SnKXRTnr65c6e8kWWcGsd9M+LfOSFz/g75/ILpf:SKXdm5q80cGsd9M+LfO6z/g75/ILpf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
3684	msedge.exe
3684	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2900	3684	msedge.exe	82
PID 3684 wrote to memory of 2900	3684	msedge.exe	82
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 1136	3684	msedge.exe	83
PID 3684 wrote to memory of 912	3684	msedge.exe	84
PID 3684 wrote to memory of 912	3684	msedge.exe	84
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85
PID 3684 wrote to memory of 3568	3684	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac0a76c1252fcfb830cd598e5604012_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc49f046f8,0x7ffc49f04708,0x7ffc49f04718
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12798711049317028689,9077887785608576667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
70c02f4fb6b632618003a9b6e1d0bcab

SHA1
8310126058597bfc0a438c06b7c7782d6dadca91

SHA256
e2d19cbd66b38a3f6e21cdcbef9e1e5dda2a78adb7bd58765328739e5e030f1e

SHA512
0846773e7d99dd9b11403cdc9b503b9198c2ce1890719547166cdcbf19b7ae9207d227e1127086f0e86ffd4794ec7cc87a301028e2f97a342c3c020949feb113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
782038f9d87877923e569fe5d9f3bcc4

SHA1
616f918eeeb4720833f3c26da381e6ebcdd2338b

SHA256
847272df4e28dc1cbdb71cf728ee29b7607e5ff3353c85cee9783bcee696ef0b

SHA512
474b3cbcd11b80452f569cb77ee70091c7263a2d3e65cd0e4e571842037f3273cb2717b2bb9a76c767ac77e3b2a212283af78cfebeb1818a98ce0c7819a12b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
45b4a88d3597cc0d11cf2a47c4ceafd2

SHA1
d8a3cfbf9d2413b0196a137284c946d249db0e35

SHA256
c840935d3ba0e887f825b607af90c6fbe134d82a7cb879eb39ee7ec4e1e90118

SHA512
80b49a4a06623d00e79a25922a7fbbca17017f6296ee29feafd3cee9b44fe12b1f6faa932539fb564248f689e0a756defda3282cf52a59c3073dea91c1dc4c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04c278845ee256b7ca0cb7ce4e36945f

SHA1
b1826bca0cdad6d17b86d8c6a47d5920f22b3a41

SHA256
a3c428faf6e127a16e43b3d220f1c09de738f2281c12d9d795993323cf4b0478

SHA512
44d75f854823fd6700dfd5a178776aa3b0dfcd7a77232b46c1f3ec03a917259d562c5322de75040524f8d86a382bd44720c86b46a99e4018c57e8311027d0e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9933a08dafcc8e12d73618a37adb0bfb

SHA1
fa5166c396e0001747a51a61351cf766e36e3f44

SHA256
621672c0c6d37742dbd2ad6fec9fee769611bb1980d397ab18a445e63e3258ae

SHA512
2e4ed59689dc9cb926d88134b16a96666167542bea4875d296351ee836e8479d696e34e073e23d296590f52717218a6ed31565020def13657d01830d40c3fdc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a265687ee2907e39f860c76c12ce2823

SHA1
a792459909936ed77b231af93e31722bb94ac01c

SHA256
a1670fa1463ad7d8477a7609fef267a2650e3eadac09aa0cb423e8ae8823241f

SHA512
ea2da3818ebb70e0682cd0fe1d56add27c4fbab069b3847ff84b99856f41abfcbe2749d6825849c867d45c5ca0da3a83f09adf316ec3e106e0f3b36750740266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f401341f01ed36f1ca64417d09558ac4

SHA1
5c8cc2466accfd821c1020c529a1f5b7d445d09a

SHA256
671a315edd4df4b65409210020fb8d5e7a1f8ed6e77a4b24fc37702503625fd3

SHA512
4b61abdfdd5172a0512c8f2bba902502325bb50f7f51be587b52ff721ea43d9c8a46ab16cab88284facf78acb1e597917f5df27d37c2b262b256b2dc0a12f709

Download Submit