54b71c35989c32ffd5707297a24b0f9d54d5b016cecafb202e7ebb175952f509

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6243a5f8c1f2bca729da90f27a55b24_JaffaCakes118.html
Size

82KB
MD5

e6243a5f8c1f2bca729da90f27a55b24
SHA1

bc173cee9846b7ea630a1a5ee19af06a7195fe6d
SHA256

54b71c35989c32ffd5707297a24b0f9d54d5b016cecafb202e7ebb175952f509
SHA512

c4e337168423327de6dad8d46509e2f996a80245476fb30751305dc8560c20f66d2f709ca4f25697a352ed8f50cc2aa5a9cf716d477b06495d07ac92e24562d0
SSDEEP

1536:XTgZNpBqLWpPo8lpI8wpp/mLmKm3mVmIm5m5mVhb1kR8T93KfODjSjLdKPtN8/:XT8pBqLWpfUKAmjLdKPtN8/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
4252	msedge.exe
4252	msedge.exe
1712	identity_helper.exe
1712	identity_helper.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4380	4252	msedge.exe	83
PID 4252 wrote to memory of 4380	4252	msedge.exe	83
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 4572	4252	msedge.exe	84
PID 4252 wrote to memory of 64	4252	msedge.exe	85
PID 4252 wrote to memory of 64	4252	msedge.exe	85
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86
PID 4252 wrote to memory of 3208	4252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\e6243a5f8c1f2bca729da90f27a55b24_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd426a46f8,0x7ffd426a4708,0x7ffd426a4718
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,1539591671302627397,9461863968950472997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
336B

MD5
84ebe76785a6b4f02669adba2256a23a

SHA1
dcf8bd82c503dad0bf7022b7d538a775e2135789

SHA256
c8e6ed08a0a76567cbc9f6e1d3570f9d45d5bf6711c44f6bfa148a3bfc3e8bc7

SHA512
53f27bdd0e72f0c5a6323e9543e5912435a8c23b17b9f46f494f099ca9f293934cb946c90bbdcf1d4859c73ffdc68342c7705e22144c190e8ec6f45dfadc9d86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c74db147d854e1e463c1f48b51abed84

SHA1
0ffee08962d6a329e31f1dbf3b76affdb6eecbdc

SHA256
391c4b9d21c28ffad23631e2adf62594c5067be7e22e44ec59d9b2e2483a0472

SHA512
fe4c4fb37a4827ad825f7c2b786e37f8632c960036d17c5ed3891bec30d7369c541e93f78b61422a99d13f0b7d0e4353736403d508180fa37bee792a58af4f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b242fe5d3ccec0f3e2148fa5a0a19190

SHA1
d884f0cc8a08b9f2fd00a4dea7f04e44d37c9459

SHA256
e9478948017d439e37bd82dbcc9c4d059a29d691f4e1e1e4e0ee91a794bacc3c

SHA512
8bad00a60a8177ad09f0e5a631c93b007d51f718017128f2589d7f931c53cc8ecb075cc57b0f4fff4aa74e2003c9e7347cecee9551bde3e0f157de36ef5ed8bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
84aa8cb835bb1cdba3a32cccab0695a8

SHA1
1b8445aa12ecf63619e299c84b1acaf191ce79d0

SHA256
25ad9264133c999731440fbe49d43624fc3e63dc09154c17e30a7b7b3a52bb45

SHA512
e6d41e8f6294b14d4e43590e36eb9e9136926d26e5848885db5548d1a84c187348e15c61acb87c9429f87e7da465c52e1a01f870136ca28e3dd9f721ecd18b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a24a3782b5ac8cf856b03231e4ba2ef0

SHA1
ca3deff811c1aee1d14c624c533750a213ae8baa

SHA256
664e37243c3f29070f6d3da0caa7f32897c2bdec396d02ac25fa31520b6ce87b

SHA512
6aac7853e669b33d070b168815e7f7b4508c0c87ac4c03c9f46d9a77a3e2ecd0364a19541b956b3884d499627e3ae529a693569ed544a979967523ddc91f16e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac0dc3563e2bb42a36a306f1b6db6e41

SHA1
1c8e3b537c28533bc933077b9719db9d4d15943b

SHA256
65aa2a80a37edd828ddd2160c3b55487b8a65b469ab7243e1c441e384ee42cc4

SHA512
ef8bb937cf9d87e9181915942f2742630b6a6813f57bd64f3df34cd7867972993b672848350272356bcb0f3a3424b16d94dec1a09dc3cb7081255a59d4e6cf25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9af2f33a81b615aaf8c8c6107e4dfa4a

SHA1
97b352cda3dc2460256e2a15b8c56a575f7728e6

SHA256
fca2802e1236f7cc19dd626889155d1b302f4f9abfcdf07298b7493bd8de61b1

SHA512
6e1426556e236be9922499e848ff8a783b23aa6b8813997dae6aeceea049aa22c4cdcdea9ac984a4055c190ab49d6f440521f04939726414cddd078450bc6cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f4aeaa7e0077baca32d5f038fe85325

SHA1
f294e14e1c2f3b81dd0e1da6e4cc831e9b0d9d94

SHA256
f33550f72191b2b430fe8268f5f40424696ce1bb1c5a6b4609af678b983f91c9

SHA512
e6c444238b993d9d478a0d6be2a2d4a60a3545decfc2023b56fde07eb45aa6d63155d7c7c5f7e181c0f2187a3187facd0cf6e15a5f9da5b1dc78d198608166c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e765b8ad29ce3522311d46af9e5a0fde

SHA1
08e5b5e031610ea69969d9a478e1465e02a1458f

SHA256
f8e69301fb7fd0ab33c4f46b8abaf2e8793a9e847e65552c4ea6d415cc103e1f

SHA512
f057e91844b7188b60a7a0c94460f1a2e51fd15dc5954f8034d4531bcb0e72a18186d06a84100c31d09421fc57777447c71f97d2850e3725b01fad7aae1dd321

Download Submit