1ea57d73f884d76f8a5644aeb9c8a52f176e8946e16ec78e579184423bd1e960

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0a3dcc8cf7867fd49f989ddf4fedc15_JaffaCakes118.html
Size

175KB
MD5

d0a3dcc8cf7867fd49f989ddf4fedc15
SHA1

9f3552350dadae69215517bd2405119ffbec579d
SHA256

1ea57d73f884d76f8a5644aeb9c8a52f176e8946e16ec78e579184423bd1e960
SHA512

8c15e57565b89e5a8ed936ccaec969f08d512a740ef01fa9776d3721e2abc5a18f86c2fec078187fd9665e24ba6f8922673116e21d1aea9f421ebff66e1e1723
SSDEEP

1536:SqtO8gd8Wu8pI8Cd8hd8dQgbH//WoS3jGNkFnYfBCJiZP+aeTH+WK/Lf1/hpnVSV:SaCT3j/F2BCJi2B

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
2176	msedge.exe
2176	msedge.exe
1932	identity_helper.exe
1932	identity_helper.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4884	2176	msedge.exe	84
PID 2176 wrote to memory of 4884	2176	msedge.exe	84
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 5100	2176	msedge.exe	85
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87
PID 2176 wrote to memory of 4764	2176	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0a3dcc8cf7867fd49f989ddf4fedc15_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9835546f8,0x7ff983554708,0x7ff983554718
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12960301618907330258,1951752186765474136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
213af7ac1aa72e2c0c316743695b7cd0

SHA1
c93bf2de82958073a23b3a495356118ef718cecf

SHA256
f5680671f5dc330f962eb3de4164654e2c17284ac3a109f687ddabf104e25ce4

SHA512
d0e11f42a046682805d18a0a133df1c8c4272b94117de503dd4992c34f93e516b7decbf77496f45768aeb1a95f1493f74f5ff732e9b42efa6bff1b47e9b0c1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
bdba2402e890a30994454c3ad215f4b0

SHA1
88e6e98f4ee8d3c2a35d3a887b51cfbb4475afd6

SHA256
391d38181233d42cd6df6e73e059d6837cb914207ea1a472a7bcc59c02ab390e

SHA512
66820708a2d8089a4d37678e67ceb1cc0371440c7c6b5b2bdcf7dcdb16174263483a61fc3acecb48851eeca701213ab264a25f14472780200c850a1b3752a3a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ea86169d765f3b5318c006c22239068a

SHA1
19d485bdc15c6db069ec17f1166bf4c22f1d675c

SHA256
94759d60946735c97486a7edc46bccc7712876fbb6ee6e6d1e5178935a1f19ea

SHA512
44a42e81d270f30030b219ffcc13db56fb6f2e9eb652727d75c99376bb407f5d3061bfdf116f8b3368ef9ad89194d9b3090f928e5aa36b0e89695966d3e33715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fd11d4f68308b43d3fe87809149c119b

SHA1
c71e28cae952da85c8063a4bd790794dc8886081

SHA256
889b13ff4356a04dffc913115df4be10c94d153956f0be2e8f6af6ce8bfd5d25

SHA512
e5b27740d983a6301118a466c0d83cd48c961b7c265163ad6127c328e211850eab008a609937cad797de8c5dc91e7d965d3f02ef70694dddc7fe275344631f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e2de216c7da2a7ce195ad67f8a9b341

SHA1
09086aa950b496244bfea089827e81136cdaae23

SHA256
fa16a5dfb6bc03edcfbfe6f3b39e4644bb6312ccfaa30931600d33c6be1abdad

SHA512
2e40694a8f971381286b0e5957da077606559ad7171ab764f29f3605b853fc009019af41fb977d75f15a27fa9f9559d7eafef82ae0254f2ccaf8f6b7a1181426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a34b3e0e8d51e4d96b82200c0a2470f5

SHA1
05a5a63f86ff097cfc31a76db12c0faa7ab5fa5b

SHA256
059ae2fb3a17cca144662a58d3663a9670418d399af03bf18dc04a425623aa50

SHA512
d086e43a35d4ad283bf2abe0f3597fdb67076bd2a00a77a7f5e2d3f18e69866dae6361b1a0cb7d8add25c499ddf26cd31760390b11b68933b350676d8295c169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
04b50112013200e78f36025a00defd3d

SHA1
29ddddbc103dd9827c7b5fd3f9f56fb4e9b85436

SHA256
ef80374866e94f89f02b0ae0339e458134dfa9cebe66ddbd6c56b0874dd87bff

SHA512
b83b48a57749a0a02db6a9083d176ca8604f8880f0d07622f4a8cd23e458d708ab3dcadefabf7ff88dafcf760ceb9500ba3019b805b432475d517b6a1738eee8

Download Submit