d2131ffbfd56bee1fce6561c50d5f7bb7ccad4ddbd0e63cd525f1563a625bb91

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11cdb256e4385da6035ea4309bbe33dd_JaffaCakes118.html
Size

46KB
MD5

11cdb256e4385da6035ea4309bbe33dd
SHA1

b47f60063633c93b9e8b0bfef85579ddb4f5da59
SHA256

d2131ffbfd56bee1fce6561c50d5f7bb7ccad4ddbd0e63cd525f1563a625bb91
SHA512

e52c720e7c8488c4ae8cd86fcf63043c01fd921b30cad375f06776ac488fb86a6910cbdad01d7f763c1d89c78e5faa161195d5c9447bd91c8f6b4ba9c10776b7
SSDEEP

768:zM6oa+gpaEWlyHdfqlIrEzeJ7mUlfvAes5AG+yK7qVqRJcFB2SUO:zM6oaZsyH2zeFmaofGryK0WcFl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
3232	msedge.exe
3232	msedge.exe
1892	identity_helper.exe
1892	identity_helper.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 1584	3232	msedge.exe	82
PID 3232 wrote to memory of 1584	3232	msedge.exe	82
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 4012	3232	msedge.exe	83
PID 3232 wrote to memory of 916	3232	msedge.exe	84
PID 3232 wrote to memory of 916	3232	msedge.exe	84
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85
PID 3232 wrote to memory of 2020	3232	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11cdb256e4385da6035ea4309bbe33dd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffbd21b46f8,0x7ffbd21b4708,0x7ffbd21b4718
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,15264057642867350593,17515825814336291097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c4bd66d530cf2e7fa7ab439613cf7a56

SHA1
0044fd69948bb788cf15841371bdb074b34cf84f

SHA256
bd81decd1cd7855ff6e3e2119dbf76aabd9c55a3027c06c0322238100bf751e6

SHA512
2414e4f733266df31d75893651d9d96cf4d8afb4ac376c1c6ca8e612c0d44fa800f4a52e90db0f5e1fe25d3746571d4cc02fc1959b6ec4c15be254270e0a2250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e66f4caea526a8a5d0ce326baa167c4c

SHA1
77dde8711bfe22d3f3363afacb3992d8782ad694

SHA256
2f5aa7906ff43e93c7cc3b15b8699c3e0cf3959290f29fcde3e45a752f678ddf

SHA512
eade2b530270f43d38392c32be1043029dd25af3aa57f9c851191694cecbe53135ecc6ffb9fd5071cbd15a4a4c453a77a77c28f9f7550d4c596a2cf59625801a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9637f6f2705e012cfa91f8b6912c7d6e

SHA1
ca3bff037fab806ae9323f7a146616031fbe5160

SHA256
01180bd3a44ae2e9de910bab5d217233760e896c7a012b7f3304dfa648c27007

SHA512
930eb8f732858d374c83b4714e7d3536347e49b3f05a4d41686b6c79196b12e4bd34751d29bfdc07c47525f33d57f9dd6f7ce2da53dac767adaaf8548917a3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
678dab586ecaf112157e969ab9f30c6f

SHA1
fd167fbd38d1f9b65da779cdb6f1cfd6320e95b7

SHA256
81b83e8567c2a4c3f979e01db65ab517dc04df34a58dfcb8fbfc426605f4d685

SHA512
8de81e8ce0e4068e45d7f004014c1d51386649ec21502bf989aba64691d03c2f56cf5861e620254c02660b271f05a1937f6faad96ff0d23af3771e738e373b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2abed26e779459c5eb22bd0e4ebfaf60

SHA1
e08d3b8f343b428115145464e9f6ea4eae6f6938

SHA256
b06aaaeb38550f333073f61f689a55450f01fe8d6563bd0a240530c026d00419

SHA512
739eb3d2576c3abf12c265979b285e39ad10d72d7b01a7e72e93b6ffcfc7ac528ba1092b97665d1206aecb6cf8e327fa51ffc8339b36708b2c14a0c5b543dea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea04de643e09d6ad3e5057aa825742f8

SHA1
c13c480a36e3b23078d801f5f7471bd725fa59ad

SHA256
da6ef1aabeb42bd6d9711b0c74369b5e74cbbdb3dbb9c91a0bb1a971958f66f8

SHA512
b7b6a3550d584f5b6fba502524e482599c561b3dec34e803c192bbcc0bc7d308abde4b1ea46b2ee60b315d0b39e9a5a8cae5a69031ea2809e06d730fc29fd7a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
04bc14bf0b9789b51ddfaedbf8da686f

SHA1
82e951c0e230b55ef1a4f9c699c7b4a3758d49f6

SHA256
c3068fba928ce37e22e2f432d650a3d3a790b7a7b465f93ed5377c400dc89cd1

SHA512
73184e7887b14594fb90f9ab55997557342af5545a2d4cf814d61dd3f20611c73547f4e6547732177790b90fd7ad0148f846b0d56b0658a2b504f27542c33ba1

Download Submit