c025f51445d81b526a751ed4471f931fc40b1f6e7269c90a3171c400accd6a6a

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c936e3fd909565999633aada7fcd7605_JaffaCakes118.html
Size

54KB
MD5

c936e3fd909565999633aada7fcd7605
SHA1

caedd5d13c0589b0ffd7065a9c9b1f7c90563d04
SHA256

c025f51445d81b526a751ed4471f931fc40b1f6e7269c90a3171c400accd6a6a
SHA512

8496ccaa730310a4980d92b64047a5b39fab0212a3b888026993eefe4e578d1916414f315b7a044f9abbfc76e57771b91ae17cdd1d72dfde56946916774dd693
SSDEEP

768:H8T0EipBLdqAuc1OKze8ZFKY2Tpu+qKc51yUcssyJORd287545h:cTupBLdqie8ZFQpuwc32ny4Rw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
424	msedge.exe
424	msedge.exe
464	identity_helper.exe
464	identity_helper.exe
588	msedge.exe
588	msedge.exe
588	msedge.exe
588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 264	424	msedge.exe	84
PID 424 wrote to memory of 264	424	msedge.exe	84
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 3560	424	msedge.exe	85
PID 424 wrote to memory of 2272	424	msedge.exe	86
PID 424 wrote to memory of 2272	424	msedge.exe	86
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87
PID 424 wrote to memory of 1592	424	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c936e3fd909565999633aada7fcd7605_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb50146f8,0x7ffbb5014708,0x7ffbb5014718
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,18247385423125809573,4743073986669989529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\449d5701-17cc-4c0f-b31f-6076cefbe2cb.tmp

Filesize
1KB

MD5
5d87fdda9fc2608ca21a117997717c64

SHA1
2693f0e2baae96c82dc9835104f0c26ec0388c7c

SHA256
dae0d79d33bb9fb2c6292f5a3db6f0aeece3e65dc44cf31df0739e74347c76eb

SHA512
42043028f1dd6792e839d0183630223f504b0c81064257d1e236b7936a6ea71536d29db494515eded027a1130ee9491b9d6116d3d738c1983fdc631af03be6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
d432187a3771935e0fba0c54e25cdc81

SHA1
7266e13969cab6c288b06435c3476c164e3fc41c

SHA256
9023a12696000052d6e6ea2de5d751bae0c856f5351c0afcaa5311810c1ab482

SHA512
6843195e34ba5557e9adb4d17d78dd5392c571cae03b1ea6fc11bc5ec923e0595abd02a43b131b4e1dab363d12252b9cc544b11e72a2ee30d586fc4df4a34268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
667c3e16f28cce2709fd1446574a97e2

SHA1
0e5f8ae008e0d7a549dc50ac21b57404ea4e0777

SHA256
3aadab06afe84e23d5944d4128740b61fd6d7c386cb198e1f069c35b9b03cf43

SHA512
5eb4ec81ee8c131bcd6616da6184d3e867970208df7f760565928dbc7b43bc03cf6e039d2f486f8aebcd6367a80c9520d834f64dc9779c06c01856a4e13e6136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7f1254af4caff8de6fead7176c62d65c

SHA1
fc74aff8c90d379509efcc5cede44a108d0cf135

SHA256
d74f290aa9f197b3078874321a83f3a1c6d8f80dd9f831a680aa05e2a0165c85

SHA512
543918fda9200d6105b2ff2279d4f33a6fb76d105d034963bc4f0919ad6163c5f3d81e2743e4cb15542f545775b26722e524131afec1441e7bf6593c66ee0fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e39f3eadd1be27c59943d196f956a9f

SHA1
0e483eebe5dbc6d20a0cb7d46565902420c2e061

SHA256
7e654f0223bf37136a8b1f2a5234d04acc2dbf69c16b39045c6a136581b81b79

SHA512
af52d7ce94be34b24fefa0218f1ac258c7b58dbf1f75a4495997721c940e71bf145affe88e358dd25605c723b816e069a3c9ea8075c69b8eedd8d22057b06bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f1176b9c80d35a08c2a6cd211a9cb6a

SHA1
7705a97a8a4529455d27be5a0185c7c549ef05af

SHA256
dbab69b1eff5692dcc2dc80e94bf860eee39e7a19d4f13512785ca27025b16cd

SHA512
af28f2a4ca850e7f828532000786991480ff580e39b7c5c558f2602a947b5e7b16179250e750eafdf7c050326123a668a213ac69b8ba509f4487b54716dca4f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
92798a35b81047653d9d961c36f8b576

SHA1
91524d11166d0ee3bb04dab7a867cf6e9795da6d

SHA256
194f765cfa903ec99c44bc0b6470773f55476f3a3e259b4db2ab91f676b03e02

SHA512
d25fc257221cfb0a7cac2c312f58a11284a558d7ec49714aa52f4c2926cd6e9466d4b44fa61666af5d454210f3f85578b3a682b6ebe251035dc2a7df33e73800

Download Submit