a4631022c5d15e7b98efbc6688cc5c23193f0f84c9642b4ddd36ab43e95e4d69

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

466fc4fd53b556a7c1d21e47201f45b4_JaffaCakes118.html
Size

46KB
MD5

466fc4fd53b556a7c1d21e47201f45b4
SHA1

ee036b9e6733d2937b470766b6cb17e660e1b6fa
SHA256

a4631022c5d15e7b98efbc6688cc5c23193f0f84c9642b4ddd36ab43e95e4d69
SHA512

2668a2acd34d4d72678261d94696d5d3336b2757717170268a3ae0fe92f48efafb77a8c5b4232ac8559b6d704f0b7beac585f62d9135a2ed58d2b4a66b721961
SSDEEP

768:3lkSgOriWNQuavoLGbDw2H/XqG8uNUT5o29Qs4T:2VDw2p8SUT5s

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
1600	msedge.exe
1600	msedge.exe
628	identity_helper.exe
628	identity_helper.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1756	1600	msedge.exe	84
PID 1600 wrote to memory of 1756	1600	msedge.exe	84
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2232	1600	msedge.exe	88
PID 1600 wrote to memory of 2088	1600	msedge.exe	89
PID 1600 wrote to memory of 2088	1600	msedge.exe	89
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90
PID 1600 wrote to memory of 748	1600	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\466fc4fd53b556a7c1d21e47201f45b4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff291246f8,0x7fff29124708,0x7fff29124718
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,903352196595090163,7419750087715971450,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
6fbb8d8e2ab3711a35e2594fc730a4a9

SHA1
1641b9048ce03cddfac011eb085c338cd3872c8b

SHA256
d0c4996e134ebcadcdbbf6b2507088ac9fad8803a0c4cb849722c276c36b94fe

SHA512
fbe54cf1eb1b3028335ada28dfc4d91b553030fca4fd7944c5f67d9ed650f0e1071834ac80f148bf6c07c0ec245f79cd47dd1eb579d40673cf978d770d1de2e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6bd18237db26b4079cebce2ba54c08af

SHA1
d31586142e24228b6b8ba57435f2a470173fa1b6

SHA256
3d7c173e7b906ea8d03cffb2399913a6704db179a56e01854636589470de1f2a

SHA512
4b911e71b0032b3bfeba6e39ca2663b2f68d7264580d2a9e1018bbce1d3f6764409e2e99b3b15e331f68ffe82ce81424f2aeda570644280756d44614025dff27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bb3bed304e182238373972ff7a39107c

SHA1
cb9be691afe3a9816e8f118ea1f0d4b4fa2b5ac5

SHA256
7a63bd5ff7bc423f9a437d35795fc178ed64c3e1c6bd14cd394e6c20fb8c4347

SHA512
6f602e4ffd64b7ce686ee0cd9bcddf3862dfe9a5af0068f9e263007c393906d6c64342f9ee394291b348705b7b298bc983bedef2b1f47492aedffa59f811b7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b86e340bab861ba735ac1d9df0fc1faa

SHA1
3abf78f8844219c6e81d5a8ab840b38822bad135

SHA256
5175fc1a30743b1d772375b3805313a6f965cc064f59c888751e972dd3cd44c0

SHA512
4a0493886b9ae717c73fffcd1af84eefa0b69f9d0458991252841091bf82cabbfa1e03c10ddf16138624fa658e27499e817feef1a0364a6285e2101d7495f4c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac0b053af5bd7360f3007e0ba9ac294d

SHA1
2ca9de2a03dd36735846c54dd3aaba67210c1140

SHA256
9f32637e5d4349ba4e45ecb17703936dcc988bff5b297984375689581527eb5b

SHA512
23e84e4cc0ac0c579af485de43edbe850adec67cffecfa9d9c9cf30b3b15b6af394b7e4845dc7e6630b3189c36afcbe515910cc8ed45491d1aa467439f14a594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37c281f1851bcdd268b5c661e02f681e

SHA1
0758a64b23580a68bd75412bb52dd29e91cecf78

SHA256
09bdcb48d2281e8020fbd6923966e7e96e4552583d6360e1ab93caeb12d5b3d5

SHA512
0f56d59a32fa5d9003cc340628fdc90bfdafa83a9935db83838a9de1a69e2198cdba743a40c168972edc8b09be4a1977219745f9d8f720797b8ec1a3115343a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2605a77216c44b5e20139d25fcba0513

SHA1
fea7a4102ec8e95c952d0f4e70c7137a87b336a5

SHA256
3a478a1d32ec1df34fbe18a4898efcdb0494b3f4d1137e8306ae636334e74a4c

SHA512
49f050428ebc212f0a2d496bf9ae2d0750f811621445839391500da95710087595b1a7422a2ca650ba6fbfd74d8283f3de0b878694d04fd229338a4d4756d08c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8bc7e79-b60d-4dc1-b398-d170f8bd643a.tmp

Filesize
11KB

MD5
dfe0108bcf44a3d2dd924fcc55a1c0f6

SHA1
c3b48a5bea2811c10531725bce22d395924f3a0e

SHA256
932e44ba49dafc9feddd3ba49b8dcda38a0970ea40929a4d2dadeb49063da568

SHA512
2367d74ff329e670669ec160de2599dabbf4998a569a335a0a5f68705e732667d4c927cf000ef9790a814a26d86de5792c582c54fed09bac94fa4186f6a6c94d

Download Submit