8a4964fcba9f783a25b59c2e6eef9d95552f71bad5cff4777d11542d20691f0e

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc816b59bd7124625158151266630d2b_JaffaCakes118.html
Size

35KB
MD5

fc816b59bd7124625158151266630d2b
SHA1

ef8c859a6efd19da0180193d4fc593ebf7d45a8e
SHA256

8a4964fcba9f783a25b59c2e6eef9d95552f71bad5cff4777d11542d20691f0e
SHA512

6a8554029add73bebdac8d7e9367800ed8b175b5b9918d17aa221bd45b0d4e9348169401e4e95b58136a2deb4a837e1fd63249c681a7989e7a59efddc12e265b
SSDEEP

768:x9BM9Wp/V02O6TOtqJL2PQOEDzFA49Lqd:x9BM9G/V0hYOW2PlEDzFA49Lqd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1784	msedge.exe
1784	msedge.exe
3580	identity_helper.exe
3580	identity_helper.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 4808	1784	msedge.exe	82
PID 1784 wrote to memory of 4808	1784	msedge.exe	82
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 2272	1784	msedge.exe	83
PID 1784 wrote to memory of 1972	1784	msedge.exe	84
PID 1784 wrote to memory of 1972	1784	msedge.exe	84
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85
PID 1784 wrote to memory of 3408	1784	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc816b59bd7124625158151266630d2b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb974046f8,0x7ffb97404708,0x7ffb97404718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5957458500928234572,7144943240095007485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\879a14d4-cdef-4691-a884-e416abfc9696.tmp

Filesize
6KB

MD5
9cf88bdcdb60a3f3296709362586acc0

SHA1
5c21edc6319b64647cc0617d0846de19cad9abde

SHA256
ce4b0df12f83ac1952d472bc80a8a50e53201a94c587a5cc10323e3572dbee06

SHA512
f3bca0218866cc89a038db894cdfeffcb0cae8d047e07acd7d7b88a01d182d9972a8c7deb9fd3cc91b8d22c12cccaab3987936c1b7d84241f7af6092523a0343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5a397e8c13b869b4f6cc23736dd4ba90

SHA1
4e925faeef40a50b9c3bb7536dc7b9c472fbd6aa

SHA256
d61468d4a626112bd86afd7b6c4002a24f1b9f6880b97970ad9636c169ddc1ed

SHA512
429f1d727612b861e61a21b2cb4d88ae8dc03ad36f50fa658c9f15691df2e87ff504b4d1266ec0154a401c19540db8b754cf8c10ffb8200702697e4720a3c480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
6658d8ea4583b3b5fd1e64ff8c2feee4

SHA1
311e7ddb8e80d3253282db8bbb3587e0d6ad6337

SHA256
a03d8c999aeb8aa00e0fcb412dc0bc21db675fc624d4a9802b85a616cec392b6

SHA512
5a6891b2d681ddfd1733331d20344eff1c9dae0ef4169f467af59b50729445c7f958e1e7479837697712dacc39eaead36f85e92be0bee397bb7f135c0704dc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1509f09f124a2d1680fbd3b9a480f8da

SHA1
0f8a4bac18eaf2dd1b88efa8af89907017c3bf23

SHA256
c21c25338091040ee9ae0d9fa2ba6e08868e8c9f5eaee4a5b2ddfcf40e30fa2e

SHA512
c26a44e93ccf6c09441442e298b34da63e6c2ffc7d2fe649103cb3248c494bcc8efb0fc3a007731e3c6ed2bee6ce2c093615610893401912e7e7dfd9b29cdaeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
abc61c52243f5cc62063d11e36fa04ee

SHA1
b9b786f0cb6833e23dced561d7caf5d9daec85ad

SHA256
0055da7a2b266760753af1e79d4057338d7ac0130fe940b9d3e8b2dc2648d64d

SHA512
01bdc1ed2ab15da03654dd02067a03e5f9fda08a74dabe3dcc8fdfcb1f0c3b5507a91bbf8218d8b32d8eeb32a682a7dbb7853f2df212877a7e925607402e43d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a69fadfb0044c93f5e5be655b5bfd3c1

SHA1
ef5a76d2ac159cedd43295e6cf648475d0d933d0

SHA256
7a090c47f61ac01c89533103e62d7a3126e40afcf3d7a7b5d8da7d1f8284c159

SHA512
fe98fe96dc4f41ae9cd40debfaaa8a9e20d0f9518049ce8749fb3fdf7fd5b7923b2e7ab39cd03df265829e51f87ca29d8c314f7647e8dae26e5249e6e192a327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcf44beea5869264c32d8f26fc43186a

SHA1
76af5175786c9d607d284f33a77fde8f02ab0f01

SHA256
ecfc3d675c9a75a089caebfd84f9645bc59d98d1c6301ea761a3b504518031d8

SHA512
06ce4b1b0d58dd7d98b62f989af08cebbd908a7d54db447b3383440f8be152643b7b48703fd25f773c7997562268f88c97122d3a42b1c7ef2265e676e65dcedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16fe17e8f10681cf9d0309335fc98860

SHA1
16bb2ee0d8263fd152127eed6dcb15ee1d63f84f

SHA256
3da40657804d92cc9ad65544ad030c513bfbfeb1d21df87cb455179e5ad68f43

SHA512
df7e3d0d5b6f6508ffe17e9ebcee944bea39193aba655f7f6e2752a5833f869ec2b62e7394e0a5961827c6a018a81d2cb1f9879a6172f6f3d1afd1ec5e1f3a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1cfef7e13bcfd52701430e96077d58c

SHA1
cdb9541dd179879a9607e27861befb9f26196760

SHA256
5031bf4ac791a851234bde4bcac6ee14e7a7c1bf04614cfe4458def1686e3fde

SHA512
93bf51d8742d93fa7474686f725d2c8079f1b6e6f54c30c7a7b08b2f7ea87e9a045415a43e123f942f4fa0d930f44c051ab5e84e51924d1793dbdde690f29d07

Download Submit