7e3e026ed6ee199a2eba92fa255691ddf9805f45dcebaeb7d8e5d0f207b8e0d9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9a42c1d01fbe7157c0919f33032a5064_JaffaCakes118.html
Size

111KB
MD5

9a42c1d01fbe7157c0919f33032a5064
SHA1

fcecb558e8b8e73b40881eed60c3de748a14ac18
SHA256

7e3e026ed6ee199a2eba92fa255691ddf9805f45dcebaeb7d8e5d0f207b8e0d9
SHA512

70f8a13d4a7955a521456937dbd8ed3e680e17f4c0e10bb705b902123ce2240ee4964bb8504ab0c126b043bdd1bc83d79d63b418fc3af65ff18a7976cc1ebed3
SSDEEP

1536:5hZuIqOqh6oo/VbtY1j5PALKaFKXWY3JEtLvllN:BqOqQ9/Q1aFKXWYitbllN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
980	msedge.exe
980	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 3376	980	msedge.exe	81
PID 980 wrote to memory of 3376	980	msedge.exe	81
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4996	980	msedge.exe	82
PID 980 wrote to memory of 4940	980	msedge.exe	83
PID 980 wrote to memory of 4940	980	msedge.exe	83
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84
PID 980 wrote to memory of 3020	980	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a42c1d01fbe7157c0919f33032a5064_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9cb046f8,0x7fff9cb04708,0x7fff9cb04718
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,14055465553634720499,14981275105473182688,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
134KB

MD5
f9255a0dec7524a9a3e867a9f878a68b

SHA1
813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b

SHA256
d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d

SHA512
d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
c4ca558ffef4be2cad3b66ce374ab4c5

SHA1
dd97cf41b7876570ea407ccec8dfc8efe923a294

SHA256
8e236368200aca80b0d3932f1076fdd593a388a7a09aa460a35cfaa1d701f6c9

SHA512
9d3ef6a237f5418f8ba9bf29b054210986e059ef08bb70b8f5f331e035627ac10af536318db6649dd5efe194c805153f2eca6b4549cf9a7382c6906619a2a806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
52b4fe8e2e07893b8ac16b5f8dfdc0ae

SHA1
a31841be4a11c8405ba860fc1b5561d458f0bf15

SHA256
b55d4c7022bfff1e75ef3a74426903362f7e65f9f885d2b56cf70e324e2619d5

SHA512
af65f488b261af0f48ddd0ea845168a7dc39ea9dc5d833caa5203b724a2a693258c49853633cb3e6c888cef64617cdc27256f52fb095d6301d33ad94800e94e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0f7483ec9c0a9ef9dd3c57c48585bc52

SHA1
66c082170d96c4590ec05d43deb1687e2a3451e6

SHA256
c01823a6b37e2db7492f6c5888beda008237523da9deb38382f072add1309e97

SHA512
3319890565783aa0cf9a5470a99049e9d4496f706c01bd811c5d8a582a3473c0f88244748ee33b135bf96d9822b93344a7989401431106cf12a851c95fcb7d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b3120804a6417accd3cda237fdc73111

SHA1
8d0f307e86ee3551e35621e18f4e54ba10f3fe73

SHA256
1601a66255809ce492931aa05f48cbdf9de77ff30f56ee12afc1ebfd948c83be

SHA512
e44c8ef30a73aae418aede031c2637c35c8fcf96f844f332d523fb7637eee911d325a850942016e432b4cb61976f8fdd8227af18a14d1b71af3c8f57ad2d5b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
251f9954fc73da29b67463ecccb2105a

SHA1
9feaa9d6043fd1900eb7f5507db862fe11d3ee7a

SHA256
15ccb2301ff813f7fe53cd1f90f83e28a4d9887187faae845ccc972dfa1a16f6

SHA512
993611683808cb2255291d505ca65a8971ce9d2fbf45b38af3cf928fc39080740e0dac924bbcc9cb7187cb987d6a0889e9d48be38121c0562e0da93f9f4088b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
52152dd8134fb4d3e0a1a4798b0675cf

SHA1
fbe28031299cea7c6015c2490a0b30d2a72003af

SHA256
7d545807c2f03b6731ef42d4fbb68ba139441201f017a93de7e55a6a3f7541e0

SHA512
394c78aa7405f626f01130c0f7db5fadbb0646be15c2d7cdd8c79c81f226bbffbeb4e87b188cfaf23a3652101062a8d4b2826f7b59623110eb7946572efacbb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6b479d8090ca999cb8f981bec1e57ab7

SHA1
a33431ccbe99770348367c9167c00711a3e7481e

SHA256
cf313bd9ca3622bfda965d61309124050133e0fe3a4db4871862dbbb818285ee

SHA512
455f5cd5312eb121b612a7a791e8384de83296d8013747b903cc2abaa70f922d2cb0858a16b7fc22d89d7d68d6b4e68b5578f8b5b7c9b08589d8b7e66b2cd3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e3e05f22d5f27d3e3694400dde4a3e8

SHA1
bb64d51531db0cc28f33f19c78013d2e0bdfa250

SHA256
9038a87689778abede807ab3e5b0c2015721b16f87a1f567cb7316b47b37ec61

SHA512
7598bf35ff59f30bcd04030d6e64036d6b9840f233f90ea5d86fa6bf48732a2819c098174d72cae543e2808db7c3cf0e62e8ab1f3f7a7091c27e9e17bf2d5db9

Download Submit