b882c50ab561b64847ca082de7edfbd52423914bd61faf899611ed3299f8edc9

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9cdc5ea8b8e8395e48f1b4e95590c88_JaffaCakes118.html
Size

36KB
MD5

f9cdc5ea8b8e8395e48f1b4e95590c88
SHA1

bf8ad812b34a0ebfb0a5842ef6dca5e9c863745e
SHA256

b882c50ab561b64847ca082de7edfbd52423914bd61faf899611ed3299f8edc9
SHA512

8952f6f1fb763c59cffc3cbf0a6da3f622ee8dc009577ed56a966b5fdbe4c61517be05df60e8046e9467088be61cedf56cb72cd02e20b260fc9941f805b68c8b
SSDEEP

768:cPVpdEOcypQtUpDoQwYkm6RM/O+whkMyRoM/dXRr3QcFEYlMDhpdbln7rpddja0q:cfMspPeX1dPSJ/LMiWo1A2PAA3fLzaK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4296	msedge.exe
4296	msedge.exe
2912	identity_helper.exe
2912	identity_helper.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3024	4296	msedge.exe	82
PID 4296 wrote to memory of 3024	4296	msedge.exe	82
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 2340	4296	msedge.exe	83
PID 4296 wrote to memory of 4808	4296	msedge.exe	84
PID 4296 wrote to memory of 4808	4296	msedge.exe	84
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85
PID 4296 wrote to memory of 3940	4296	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f9cdc5ea8b8e8395e48f1b4e95590c88_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b1346f8,0x7ff82b134708,0x7ff82b134718
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8749190712656931905,6449733930623052156,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
75e81d7da1829b084e93f3df47efcdf6

SHA1
fc350a6142ff889965c731e104e5c8e14b473ca1

SHA256
fec51466ff3a0ab9110412ef29d36b160cd75541c33fd88c0447d80966a892a2

SHA512
7a917a34be05ff008d28257620e6a153c09a8733152ed382571019c1a4471373b7cd58a7f251c3d1f3b9ae35b61513fc831d6d212bae63e5078d86673e4cec68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ea305d48ea80773895b05b62179c4a90

SHA1
389aff8173538cd3447c4eb22425f1b014c751d5

SHA256
5816b8b080eac0f85b45f2f7c7a3796bd36cdada4f229e9c65cba12cfc8c7002

SHA512
7231caa64b540f70afb45516c17f44bf66de9051d7541e631d0b11cfc578d9932cf47b9d8f7bbb4972d968e1fc082f5cc0b223c6c700b12c847b58a94707d97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aa0c94b72e2316f36422e9dd21ed7aa8

SHA1
11b80e2156cfc9913c9246bc9fc620a2ce22bbf5

SHA256
9560facbc7f15a18b2ab1518ad64bc4bd19875ba9e45a901d739d050a5172a85

SHA512
6777982ae9e33a1f785c7a96969f0566e66e7b22be7b8727b285249dff55fceb71370b1a8b024c7dedf4bb7931ac0ee6732115cc19a735829bca26b13dafea83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7d6b5a2e68f328caa46669728e91b0b

SHA1
a8d83390854bcce2f44bb30f2f9b9a7bbe4f8328

SHA256
f729a6cd874fe1749331fff11d2c4d14d50eaada5f4c5adb108de3a4b4c8f06e

SHA512
969e9b0129d5d75c366c5f2eb605ac0b998737776b8dc4c1ff37a66ba81f98f90d031692f3ef3064c72cdb3ea2ed87edc8f95cf9f72c1813a78a59c08e878afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
141cc118fdd04060683c08afeea359c9

SHA1
c1d50b672e71d2a3dd476591a905218f9d6df10a

SHA256
9b7725890a427f65224907a40dbca6979be769097a3a2adcc7d5f721c1e2ff71

SHA512
a1afa3309ab8c2bf6f753cb7d1f31884efef06ff0164268e07202c7b90bef20f5cdcbd77de62064756d9e37cd275a81a9e2c079b57c8b3d761c5e868437b4c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f37d75a7570ff1a4bfbaccfc430e995e

SHA1
17dc7c3b4128c013ca2e8c860df379a93de92a7d

SHA256
109b5b5c615669de321c5adcdcb79c18d073e3edbcca585df19c8e5b530f17c4

SHA512
0581b234be0ea0500a4a96e9a71db3aac47f0854700ef08f2dc302759694dc4f15a882f1cc4858fd2e05c957f159469fc2fea152b7e971489bd556ec7065b377

Download Submit