78b9a9fa82843e061246d7ea1b2af8d0d10cf7f3e0a3bdae8ab3b6a69cb0c813

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf024e1650f4dd17820a6564203154a6_JaffaCakes118.html
Size

175KB
MD5

cf024e1650f4dd17820a6564203154a6
SHA1

f5d6f683de18c01ae2c774182dd7210cfddb144b
SHA256

78b9a9fa82843e061246d7ea1b2af8d0d10cf7f3e0a3bdae8ab3b6a69cb0c813
SHA512

68aacc23ba1465c933b506e15699cd66110126e8a199a8b4efb05a4680168559280eca10e317f185a9b19a0a051f85c5ebe5b7085ed7ab6bb989e5cbd0a382f2
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3yGNkFdYfBCJiZe+aeTH+WK/Lf1/hpnVSV:SHCT3y/FYBCJitB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
2436	msedge.exe
2436	msedge.exe
3668	identity_helper.exe
3668	identity_helper.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 3088	2436	msedge.exe	84
PID 2436 wrote to memory of 3088	2436	msedge.exe	84
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 2624	2436	msedge.exe	85
PID 2436 wrote to memory of 3772	2436	msedge.exe	86
PID 2436 wrote to memory of 3772	2436	msedge.exe	86
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87
PID 2436 wrote to memory of 4692	2436	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf024e1650f4dd17820a6564203154a6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb02cf46f8,0x7ffb02cf4708,0x7ffb02cf4718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13778783323542965732,5146127113369769065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f11e6fa54245b93d_0

Filesize
243B

MD5
a54e837b71674f392c6eea396b9c48dd

SHA1
0f4275411d7278d3820b30eb84834d03e70784d7

SHA256
a39628ef7c37c75cedd6d5c869e2edada9824479cc51d86d0021e4bfa362f330

SHA512
be1e2e5ab3203a985ae1dae78e20acaab2a20e35f8cedc94f3ac9c3bf35b4f49bee42cc68e074a1677a5364be13586aca18f742634ed49b9730d2dfab2479b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
77f097ada5c4201a814268f154d2a200

SHA1
64bec4a9e0faf81e0dd80718ac7da05996a3c52b

SHA256
983612eaf995cca268ea67220d83ea25c246b07a8651fc194fda7e0afcb566ee

SHA512
296499b628c7a4445d1fd72e371046da1d25984f9c9354b99f70e322934b76f6df75b7f4beea68cf83094c28abcfe95cf49cd4434a88f321aaddb3e3a78993ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f850d36af8036d644cffd2de6365275f

SHA1
c2a0f9a1873b9c200a1e74de002ba0b5975f4271

SHA256
6883cb98e465b0ede7f4b76511c150b11c9ee969c74562d6d519f310e2890643

SHA512
db8f3b8e1d92411dad2d80d615d8e32181fc55c7ec21b45f6c7ede2486a2943cb8c01585cc92793cf9208001a229e8934705dae002c894137b81637ada26f073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
90f0b63b5a5732b1e59b760713641fcd

SHA1
b236e78f9c5020c7d110c967e68477f52ff10619

SHA256
c50c0165ff8a94bd5fb76eecd35a9490f63aba51f35ac135684d547349791415

SHA512
aab2a6f112cc51a116c0656e36702880b53d860215f7924daa0121c57464098ccc9dabb320e1ecee876df30672dc5ebf16371e19e7f155dfa3d93ca9c58e0f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
293a3d63a7da0eebffbbb719e989888b

SHA1
60352ea335066bad022d19a608e8a17d68791788

SHA256
98fe0370842eafcfbcbfb4a2da5d10af35c04f1b8632f4aa65226bb979828bbd

SHA512
6b9795263399f6f15cfd909ffa3e14ec37426937396460ffd65c1dff8561142574a4132541b3ced110de838a64a8456b53ec8a467b6c621ca0421ecdfc612c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
deee19753b864ba4e175c0dfec2f8032

SHA1
e039c744f8009273787d83750b0348bb1f5be6e4

SHA256
4e93c27b9e404ceb8d59283b1f0abde4fae278999ca0c8b020cde31031ad7540

SHA512
c7cd0644f9c44160cecc6b9c2272601294c5f1f50ff288cbc93f8840ba2a902eccf5781c450acce102642ccd4d71a7f96c55de740fa12c19307fddf7fd1afa3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d7cf26cab41c23f39cb6f8974aa37f61

SHA1
b9aa85e3f330dfed6fee4ade09ac2127a2977335

SHA256
5f11352214e53170b0f01fb51cd988ec58dccb29685b5e51de46d6719720115d

SHA512
7b0230adb50ba452a10c64729605699057686fffef9bea9bba59e06ca75cf10197f9ecc58d3f594e3bc3fbc47beb90873f2f3103a1678a10d64c5300abd41b89

Download Submit