98632bab534a99fd091d0860a238cdc78c3382f41743c71cd489825e28c34a76

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c8b8cb0f4a31fed9f5749251678c3b_JaffaCakes118.html
Size

122KB
MD5

36c8b8cb0f4a31fed9f5749251678c3b
SHA1

d453c5a3227cd9e3aa5cee158715bf6fdd2d55ce
SHA256

98632bab534a99fd091d0860a238cdc78c3382f41743c71cd489825e28c34a76
SHA512

f9c3420abfefbd9d9a8bf947a15f2d1d1ca09e4ba490543bf429c930b8cd050da299eb0a584802a4e09ecd6de62be8f53a0200e14bb1fa034fd92d8113b546cb
SSDEEP

1536:qOS6XuyBRxoXEq44g4+4145464G4C4g4j454xNoW4+wTK14H4G4y4/4F09S4O4Ns:qOS6XDN8EOogByP58vs4WfP7tVOsH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
2532	msedge.exe
2532	msedge.exe
5084	identity_helper.exe
5084	identity_helper.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3272	2532	msedge.exe	85
PID 2532 wrote to memory of 3272	2532	msedge.exe	85
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 2212	2532	msedge.exe	86
PID 2532 wrote to memory of 3084	2532	msedge.exe	87
PID 2532 wrote to memory of 3084	2532	msedge.exe	87
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88
PID 2532 wrote to memory of 2580	2532	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36c8b8cb0f4a31fed9f5749251678c3b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa006e46f8,0x7ffa006e4708,0x7ffa006e4718
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,735430926809367832,10380662568517152799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e5ddf3703ce775d518fdf358a8cd00d4

SHA1
bf6fe96dffda093d11f3a47b7239e86257ed1e85

SHA256
4f5efa6257b96b2b31133176c1e439b44a72a3578b93759a80eadc509d8cf583

SHA512
a28ce1a643ac050065b0d13e1e022c58e819dd23fb95930584b2ba746a12e38792cde1b324839dca033c408144628ab34041e9909d2ad4a6419e882c3da2f405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1d11b6e93dcc7c3b863f7d979a473807

SHA1
be240340b5dff579631ae164d21189842ac76eb3

SHA256
b2ec4d9f5b7676acb85a26f334a2335897481757c3b090001a35881a12d0c4af

SHA512
c7807d71f8e4b2d6efde3a0edd2b64d01f15da5b1a9d6c9bb21d82260b4fdf148adfd778bf199d2da88381cc7691deca26ff8aa934c44560b5ec67a169ebb94b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ee65daecc0189941d03d4552191f3e25

SHA1
94324c45c0db1c9d3d418cd58b7e2381038276a9

SHA256
4af74db4330b6357c9d2ff270c8a82b36feb8f255cbe4e6bfa66928cd0cf78a6

SHA512
fa2e2c21ade2c8a76f7637366a38d1c8e81747512df482d6c8610b45538490a6ec1f5fe1fdbb462ce8c33aeea7ef685280f6fc36cbac8b78c6fc130fbee26ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6e41c9c6a79da5e2fb7597c3488bfb8

SHA1
fb01d22632ed2fdfe9d7f95f7f439c89fea6a91b

SHA256
2e44e96d8ee1ea3e40c30adbba15a07f1fc5680ce31b85df451b2948e693b516

SHA512
b5dd9f39af4fa1b8da9cb323edd5f35820c72852256cecfe1a514a2cd66431b865e8acd67bf131d8d5f1f51abfcf67d4d8b5ac4a521863900bbf97b846a2694d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e67045729cf8fe38f2629ba836bedbae

SHA1
fb406f0b7ba61f7298a2427b5877e98a0cab367a

SHA256
b12c7f8dae6ca960dd45c76440cde3895ec8b6fdd63d902997686f29f6ca2f61

SHA512
111ee19e65746d18687c5e70a9b288caa3329a16e796ff91a1f0d7789e8b42a7d5ecad1e9608496dda1ff5ba5d89830a8a7df7294688750054ec8cc7297ec8c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23ae4fd74f8c55fe93ec1c999acc847c

SHA1
186cc11d6894c1354afb43a30104cf7062430b0a

SHA256
dd179f915590c695e9bb229011b102d5e5fa67d38595f93a3c5a4c1a9aaf968e

SHA512
c993d7253d9ece6e48718c7d3b4a114e492275643b7d1738fc00b8437ff55f40435a6bca01dbc4f4ebbe0dfe543fa4a9b7192b97b439acb6114d783866133412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b4972ad77053e17edc618969ac7f568

SHA1
e930ed5941a5ef24490a8a816fcb2797d4f12008

SHA256
8edcaf0fda3c1898afd0f8caff9e242f3044700a1192f93977dcfeab3adb3df3

SHA512
fcf9cbb91247b0983f74b837c6ca0ea57b56fd8d0a8a6590612a3878894d4a31338fa8b20e21b80804cd63dc65b222e1b6ee4cdc2dd6564e7051a02bb24f9382

Download Submit