1d834a33dde5fcb8ce13f86931938024336c9d5b7f9c6a7376d32f1b472eaefa

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

31191dabfea70e26fe3f82c8fce9fcb6_JaffaCakes118.html
Size

54KB
MD5

31191dabfea70e26fe3f82c8fce9fcb6
SHA1

6d2914709dc2d0b24bc4aaa9b2aa7e76651c574a
SHA256

1d834a33dde5fcb8ce13f86931938024336c9d5b7f9c6a7376d32f1b472eaefa
SHA512

a66fdc55594f3e5cf23226ed88a5f562cca49bb45b44443f3f806d16bc6bba48e27119eec80776f6c81f83237df5aa29a95c00f033fde6c7e19a711d0b4d984b
SSDEEP

384:F1R/ar8ZVaVL6DUFIQBQjqtpjxQjKKE1PalclkU8b+wCoIFxt1GdENrTSoyIpImI:vfapmUuQBThxQWlP3F2darTxMovtk

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
224	msedge.exe
224	msedge.exe
3820	identity_helper.exe
3820	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2208	224	msedge.exe	83
PID 224 wrote to memory of 2208	224	msedge.exe	83
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2844	224	msedge.exe	84
PID 224 wrote to memory of 2764	224	msedge.exe	85
PID 224 wrote to memory of 2764	224	msedge.exe	85
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86
PID 224 wrote to memory of 2704	224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\31191dabfea70e26fe3f82c8fce9fcb6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80d7746f8,0x7ff80d774708,0x7ff80d774718
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9403283862394503269,3404680050302918920,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
ef51c360cfc5b5677e8033e8771d87cc

SHA1
4445c6aa52c7b19b447e22780b816c82c0608508

SHA256
c96f07174e1e3a0e3198867d6a59a307dae8560485cd18ae21c0c47631d8117f

SHA512
0e159f0ea19b90b81e456889409948184a6904a97ca2d0631245d8f56030999ed72fe421c0062381b5d51f4ccb05ac43fb874de1892f317168abeafa8439e985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0c6b58fbf3a69ccfc5cc9b3f8730ee4f

SHA1
ffaeb9864dcd019a9b0d3e91f6e13ece9abc6bbd

SHA256
9ad17ea142ce2af0c0c645aa5d169c967be9db3cb4ab4e11665ca4ee828776fd

SHA512
1ecd0c4a72c119d3699eeb5b0f4495b9c57090ffe5c02a25748750a53c2075a5150f7c0e3f0ce2896d31b90090b8ddd70428cc900c7406ef80c845e71322568a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5471617f6b124085ab147a92634d4a58

SHA1
7c492c64042e7d351a8f9f7a69a1fc2a3a2b1023

SHA256
3f3658002b9a6452bf6a34969ca63879767a82ce6684b7759d000a85c0917174

SHA512
f0dad781133ba954123c712ef3dee0e8bf018ca380f08a0c73baaef95f8b2f583893f9aaba122e7e4ebeb810539997cd05ba3244d8d119854d5a5729cc50d415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
76483d46ad7a3b80b3bb755f7f393bba

SHA1
ebedbb99ac09b2a02bbce7b638195be1dfecde29

SHA256
8a9193f7fff18e8263d0083a46bb5c68dc821105c69167f1b83fe23f30756a00

SHA512
8b9a08a6357dd1dfa989435adc28000139b86d20b85905ccec883b109b9d3a0ccc90229f0e54577e661a8287b3ebd3bae771503879cce9c72b128faa7d172fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee3e0a658792d358ced7855b4b42e219

SHA1
a7dcfa230a06de15153a6d70b9ef7f61b9f55159

SHA256
6ef208a45443d4a8e34276c64c1c1ebc936225a9cf2564a1657c1943970d0f54

SHA512
d45a36f2171dd64fac91827fab4931cfb22c654fe3de5833a14bd6863399870753da6a2595ae3133fa343e99dea2fd99c23ff7299d3f85acfb5ad6f3b72d2e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
53155be5292d8795528f8e26e9f5f951

SHA1
3b2126abc94e70d4a905afbaa136115814e518e4

SHA256
d9fffc28038ca4433f3bcd0062a7290f17c6f2cae367a1d16b4e8546a247d30f

SHA512
f30db3b549d66c68ac62f2a0e00b91a1d34b4f08ea4feb32f0bd8b185b622b1eacbc0434022bb1534a221c1eec3a70e75dbfc510359d29d7ab56ccd88355f0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
26222c0f5cb2e60b068fe8de2913d148

SHA1
dae413bf4eafd3d2af72e2bddff097eb43e2648d

SHA256
cdd53de83c75ce619de258fb7faee404992aa72b2268f3595d52e730de86d0a4

SHA512
199f589d234be6bc68714aba4566f4853f4bb8c2c53654e9c49b6d4ac78b351157c9459882c9d276a711347e483fca91186f13e8b70cbdfbaec3da63dc71cd58

Download Submit