98d8f703e13e7b264ae73ac7eede4d096e5bb6853389679fea3dda3219a7b836

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37b0fc80ea5fb5f959dbbe52fd47763d_JaffaCakes118.html
Size

65KB
MD5

37b0fc80ea5fb5f959dbbe52fd47763d
SHA1

0499f3ea0aa052bc6b980423b05e9ce0ef226604
SHA256

98d8f703e13e7b264ae73ac7eede4d096e5bb6853389679fea3dda3219a7b836
SHA512

7d5ca0306b3d8ea6b431c14af60641697950e7efe78146ab5da630f8b68be7f99b0aaf3791f9d068aa00ed9f43d70b4626d744ee429b2022371ff15c915720c6
SSDEEP

1536:O51YhRVLnM8n+98pIMmaPkvysFqB3T5dtV:O5KrVLnJn+GBsFqB3Tf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
4364	msedge.exe
4364	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 940	4364	msedge.exe	82
PID 4364 wrote to memory of 940	4364	msedge.exe	82
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 976	4364	msedge.exe	83
PID 4364 wrote to memory of 1004	4364	msedge.exe	84
PID 4364 wrote to memory of 1004	4364	msedge.exe	84
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85
PID 4364 wrote to memory of 532	4364	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37b0fc80ea5fb5f959dbbe52fd47763d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ff746f8,0x7ffe1ff74708,0x7ffe1ff74718
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3486652928384646351,13137454087950427643,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
33f12360d6cbc883f478b795c8c9f66d

SHA1
f0def03592cf51cf9549a0a0eccbcb95c637174e

SHA256
4d9ab5894e7ee4af967b559db2eadfdf5169b24521b760bef4eb77bc905bce2e

SHA512
adccc71c585859cf08a803e627c18e263195e8c3545fd93a61ecccfd8c80aebedbf58978d76a5511e03348808c0bc0605f287c805ce0f055b1a680d87eeca7bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8b5df3f0c3c6cb1646a25b9e93503dd0

SHA1
f5112368d5ed609f4127999b7c8ba05cb94264ed

SHA256
c34a897cda6d137bb68818e7c9263e026c3d1ae177a65f3263536cafb147ecac

SHA512
2cb585bcd6c9cab70b8a44b9bf4a04655e4be58f52f7bfb4cc163c0a74808cc0e0a192e374004822d330a2712f47ce356f1c892070068c585b008070dedd1489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5c5de629b206323a66b9d4ca9e75801d

SHA1
b710350f742761c8183cf00c7481acebf563063d

SHA256
90b3e7b67c748ef6695ecc0db685db85acdc3ff14483633e1accb36fbc132f7c

SHA512
5ce89e498fb894a337e6841ccb9663ca336eb3f46b7973ee03f86e7a632fb9c83ffef151a4586ff215ef6447bc1a2c13d201caa67e069a58c03ca0208f074429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73a64e1526d6e434d3c153709b7eab56

SHA1
8f91f4b9eb8e9af56945f2c17d941c538122083b

SHA256
ea833f431bb452a914ca8f4f1992e4fd5b9af2185637a50f23e7d629f10d3eb4

SHA512
9f7b8f5a32d3dc0037129a8416d9700d58d9423026bd446fa12bf5891e3a17341db1b615e9a843c5fb67efce110bcf397d50b2fc416bf3357171cdc46d7cb6f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3f9b87ba5bafd35c8b41dfbb9afd827b

SHA1
42f7e8935f95c0140f8bde8b582e52cba83aef7f

SHA256
aa990d29fd45c14e24b6ef72af0771bcf0185aef714ea20bfce6bf372cf60826

SHA512
b6fc61a341d490de599ee052780a718c9124d34fb9e263336832367afe46221c16b518ef0be4dd725a964938a5bf969478f964c0058b0395b8fe70dc224dd382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ada254ccfa18b371f8e15ee72c7aeee0

SHA1
794e832317540c2feef54a2279bb79b09bc6c344

SHA256
e789105bdde685a30eae271d6c3f2f9a4c80bdb4fbf69e75ea30e474445b91d2

SHA512
cdd3a31f9c0ab532b6232eff91bc4bb7bb4609a7da7379caea9831d096f6968d7ff38305ac7bf28ee30b8a0f5cd38969781cca757ee868d5ca78332039ea7a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73ca98f9e82510b7d77d349b3239c575

SHA1
6812aed018f1553b1bda3dd8480af7e41bbda654

SHA256
792e05ca64d9c50fbe09fc2ecc3eeff33db704aaca3c65ee67d30e7ee3dd6306

SHA512
66d914a448daa34e1b3c9f87b44e9753f2f62703904253c46f80d937490973f2afb9e69760c4e479de330041e91582b7484d938746b4e2dd7b1f0924c76281e6

Download Submit