410fa4042fc08ab0db17d46089f54429e2ce3f099dcc4e3c9b0124c4ddbbdfef

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3e84bed6e9898f98d587aff2502ff8e_JaffaCakes118.html
Size

68KB
MD5

d3e84bed6e9898f98d587aff2502ff8e
SHA1

e1fd8e43d96852ae75cfcba8b423685fc2bde9da
SHA256

410fa4042fc08ab0db17d46089f54429e2ce3f099dcc4e3c9b0124c4ddbbdfef
SHA512

17c915c2c7d206a02412faafbc35c64bed18fcce409543730930d4df8db5dcd1e4ce2c79bc7153608a8a42101778fb6f151133fe3e70f44062c2d5843b28d4b8
SSDEEP

768:cRwS5y5TlpjP518KodSh9AMP0ZnjcJmhodShDaFQ0H+iwwytlkm:6v8JlpLVodShnsodShGY/btlB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
1096	msedge.exe
1096	msedge.exe
2788	identity_helper.exe
2788	identity_helper.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 3176	1096	msedge.exe	82
PID 1096 wrote to memory of 3176	1096	msedge.exe	82
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 1176	1096	msedge.exe	83
PID 1096 wrote to memory of 2332	1096	msedge.exe	84
PID 1096 wrote to memory of 2332	1096	msedge.exe	84
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85
PID 1096 wrote to memory of 2752	1096	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\d3e84bed6e9898f98d587aff2502ff8e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb382446f8,0x7ffb38244708,0x7ffb38244718
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16593950732169941231,4616776896650337024,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e028bc8-3266-41b7-bbe1-519fbac0ae05.tmp

Filesize
6KB

MD5
f1208f08d89e47da0f2814e43f7a837d

SHA1
8a1fb424c90ab3ffbec95675f3e3850e91b2512a

SHA256
eb0f0ef018488c573be2a0de47c870af04512e51d9741b65b18cb3c8a90a563d

SHA512
f4a031ce083a6abe4dbc518e6253bac1f86063d30e695fbcb949f64fc1b6f81c507529117bdea51fa775970d00d2bc77d15cfd008be97ffccc348572272cb9af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97003c7a-9211-44c7-966e-f46680240482.tmp

Filesize
5KB

MD5
8648335227cd1b593b6d1d08c5be52f1

SHA1
56e93e5c92a460c20ec3bb2186d27e9551b33746

SHA256
8bb9b972cbc275b17efcbb64ff54f67eaee8feebd4f9a33a63a9fdfc7d127af5

SHA512
06f5c0c6ade1fa0f24d0a5c32a9e75cc48bde2b1fee1c2d6eda6af290d84faccfcdf5f07b40c5b5136d330229d378e9d31d23ee9d8a0bf8b50034207844c1858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
437c7572b9da9d3e52aaeb5cb08b4575

SHA1
0dfcffc34ba9e8611349da3689acf3697e405656

SHA256
3b103989e908758aca990cb4d649c27e15a61d08deece5925264eb174c20e3f7

SHA512
c68bb74fb146a7db01aad061dd74ad875c256624fa6918b4a3c6ebe44a363511d21937f0c93f4111bb6ac84c474043b113f089e3e1103ffc7dcb9c0917db6bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
68ec29996bc5b84781cf88ff94b5a574

SHA1
5ab1f190ea5aa818fa337d2f183f591ed6b871d4

SHA256
5c9eb2fe869eb72181ccafb924be0f982e64e8852cb7f62c58e0983eacc0e9c4

SHA512
79268020b0332e2f9035bd7a2e4d03d82eb4cd037e91053a2c161bc07c8d7aa47a04adec7c362949a6978e09b4f5095b60a82b5e3cd9bbd58bb9a56e5d6f24f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
747a3b2779da9cb280de2736a70ec135

SHA1
ea2a462c15f59a0620a26f30b6e894dda40e1a1d

SHA256
6592797347a4529ade8a5c7e5d5416d77592dcdd4ff7f0be9d7451b0e4dd9e54

SHA512
4673ae9863e33edd9158fa87339d660a88a840928428182f512016f60a67655e60f305481217afc48a9ea59a7a1948251f75816a97e23f8a01dd9f0105f3b689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c27c355abd2ca76e4d750ba701790d98

SHA1
41e5aec2f31c21bf190b20f8a5982e32a5e3f312

SHA256
2422c8889f1996a88d56665e7b4e94446e55f2b05997b0ee406066bacfb9951a

SHA512
a2efd99db8a19899ade0c1e1de252482d734494476296f218c5124ed96cab3004c334f2456c59f5d89d75aad309290c58e5b6a9748e3780e5b7ad98dc78bb20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68ce9a4ae42292e7b3057afa5f351d4b

SHA1
03177012a864c5b2513c4afd9e60e944162f6719

SHA256
586b0524b2e46ba9eaaa60d42a4fa9b47de098b47d434488b406fef658186e87

SHA512
cc73b4d4c984a98c0f817d120ea94cdc83d0ad2566fd736911cca61f85595134f90d8e26cec44125cb46f66c1f36ce0d005f396d19f8841048d87238d69f1d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7b149a674bf208a16e9e6d057a9dbcc3

SHA1
fedcac32446d209cf2713b46fa45cbd335edf497

SHA256
8d5e8215f4c8264bb6064f7656591be7e7ccf6df7c58a9798f7c5fc4f013978e

SHA512
b61c0f62fb2040b19a4aba4fcd0018e94a907838a8fa0891e50f4031ef6954d3e5e493d9470215f77e1f117bd9ca6a0f7b0d58cd896435b8d199c5c5ab9c934f

Download Submit