cba374ef3facabd150fcf32cb96b56760ec4781d0992660cefa03bb862b88f21

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef068da92e997fca41dfb594ceaa7f74_JaffaCakes118.html
Size

7KB
MD5

ef068da92e997fca41dfb594ceaa7f74
SHA1

2a4d507fc88b8c675ad39108538dcd776438818b
SHA256

cba374ef3facabd150fcf32cb96b56760ec4781d0992660cefa03bb862b88f21
SHA512

a3e74a0d4a2e9c5b3b4344c239e08a40c3d2835873ae18f43f1eca67bb622dace7862edbe8134e55d13cd5d3a234d80666d47cfeb19c92247b5ac4693deaa504
SSDEEP

192:jOb+iyTAuNE9QZoIj2fATZiM6zOJLf9/SWsOkAd8jM97L9IXhz:ablyUuNE9qoI2oZi1WLl/4Ady00hz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
1368	msedge.exe
1368	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2992	1368	msedge.exe	82
PID 1368 wrote to memory of 2992	1368	msedge.exe	82
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 4944	1368	msedge.exe	83
PID 1368 wrote to memory of 3232	1368	msedge.exe	84
PID 1368 wrote to memory of 3232	1368	msedge.exe	84
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85
PID 1368 wrote to memory of 2692	1368	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ef068da92e997fca41dfb594ceaa7f74_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9ab746f8,0x7fff9ab74708,0x7fff9ab74718
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1472,6379597972502104556,7771103863956930170,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b0323f88e509439039e388e5fdaf1506

SHA1
6b87710a8e634c349814e6fb8a6232f4d52b3250

SHA256
5ded4b0addf77383f27c27d53d66eedb5556353cf37060d57e2ad4f36ae2c20a

SHA512
3abae05abbfe3a5f809b752cdf8ca03c36b9f2ca226da29db8fdf0ef2e5f94ddb7d8e1d94bd914441c69d33e215bb36e1760da322dafdd68cb597224fb9aa6cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
749B

MD5
341f12c15dbd1c0aa23f1bc3968cb898

SHA1
afb33607203d6838ca8bca06214d14d882cf282e

SHA256
76a0d52d625d2f0c6ab2379c4acde7f9ffe203baf71e4e2e740790ad581eaecb

SHA512
437158f25b8c671c36fa764456f3d82736f14dd6f2f1caad4dde7f1d1d23d7e9c880d1fe42e6049ac9d6967170d6f1de65dbef26cd7346f04b14cfb7ab916919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
561B

MD5
58dfd137cc9979407a037898ddeb0686

SHA1
021e77dfb711ddeb5e0b9ddcf97bddaf18eb1c3d

SHA256
2b2457a27fce417dbc062639e7688df3b6bfb08dea8fa85ae555309fd4b35d8a

SHA512
7363977d037f10a6d509d4f09c78c4ff823c68c8472ede8eeb81f7de91a95ed28106d54be6cb4e6267a7ec672de54d3e151c3592a6dc62d11d27475e4b2e0c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f313810993e0ad2b511d43be72ae47d0

SHA1
cc4fc2df9552682288fde1851043b30c4efd5cc2

SHA256
f3d152c20e8e28bb29a6fb22ece50960ae9feb55be73626ce1a16d2240177fdd

SHA512
a7e881446079f07501e9a8db6e3617a9a3f11fe8aaa0c8c1b23d81d3fa5d9dff3f4ffe0485ac28af058b624162eccb7f297940b746b8b903432795fba5646132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16988fe7b9cfb2b5dc775909d6793f5c

SHA1
421ba386187fe6257591dd770c000cfb4423414f

SHA256
549de3d2aa9000e2d6b7eccd4acd9aa940465b3750382e71b51019e0aa35e66c

SHA512
e897aadbb9a822513436c9cb9439ee640b3fa836a84714f9830c74e495d25461bc9e6de05f34e992c9ee3848d97626c95f6923c8ada1dad73af44c4ae717ca3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b01fff8d3b6255f2963e352cbed6d7e1

SHA1
563311fb0885a7e41024dabbe40ee0f314e9d54b

SHA256
589f766ce096b91273960a18c690ed823aab686479330710a71fe81166ee0030

SHA512
2ea81263b10499ea82f8c01131bd94d689cfe86ada0ea52e9a0fcf6c3bc9e008cdf65afc55de3b79b8dc5acae3b22127a3a66ab6ecb3e1440f412757c2b9a874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26e8f199cacf693c287246f501c41b45

SHA1
01d6a2af8f5cd8026c9c60495be20910634dfadd

SHA256
1104a6ca7bfb56b7de38c1579b7a8a89b4d7a1d8187eff43722086587e81d23a

SHA512
7f69ee64e3b96d93208bf05a1df24f3815a8a2a2517e1e47dcbed164ba706e699f51b61e7720e4ac57ff4f7a3e1e3ce4d989cef6f8af2e59b573ff17fec4aa06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dce6edf48237c2e11d112bad909f241a

SHA1
1494c44d03bbfbb638969382952ced01ec9711cd

SHA256
8ba3461e0b45ff8d2c0c9c7cb1c4ca6839cc11a09170bf0c1451d0f23a213cb6

SHA512
b355ea38f6e487368aa32a3826c89e58bce2ca9c1fd372b0c8d3a43447d7a0b32e31bf3f29534adf4fffb537bcdb621eebd82a4c6af6eb7e6c42fc70fb9af43f

Download Submit