2afe40ba2a66b60350afb45d0479a17ffc21f9aed6f2a83ed1ca8add44442e39

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d183d2e8ae594ccad96bbc5903c81d65_JaffaCakes118.html
Size

115KB
MD5

d183d2e8ae594ccad96bbc5903c81d65
SHA1

3bb974d48ebe7df404c16281115d4bca5daff130
SHA256

2afe40ba2a66b60350afb45d0479a17ffc21f9aed6f2a83ed1ca8add44442e39
SHA512

7500d16ee023ccb8dd03560673eb68f38b64d3c235e805adbeb27605281d8a642ad4dab6cc69c9afb41c899b9d9d60b94b4ed800813cdb8c9f9a29e9dce8b91b
SSDEEP

3072:/bU8TcjvG8rMdcXmNRS+ttwusl/s6l3gJQaR7Khf9n1yZXRjPpjR/2:YrXmNRkGM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
224	msedge.exe
224	msedge.exe
60	identity_helper.exe
60	identity_helper.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3128	224	msedge.exe	83
PID 224 wrote to memory of 3128	224	msedge.exe	83
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 404	224	msedge.exe	84
PID 224 wrote to memory of 2008	224	msedge.exe	85
PID 224 wrote to memory of 2008	224	msedge.exe	85
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86
PID 224 wrote to memory of 3048	224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d183d2e8ae594ccad96bbc5903c81d65_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2e9046f8,0x7ffa2e904708,0x7ffa2e904718
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5173846597414579772,3610738993020604269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
24KB

MD5
d1c8fc93e329cfdb4cef6b1363e40db2

SHA1
2d034d8d0056a8c1596714c7129fc31c74a2565c

SHA256
facc5d448f6e3267100a4c236f09aa98bea1cc3b19e2b2a0985501ca499c4ca2

SHA512
07434e4af30064d5f67158d10b704afccaa31f974ccaca5e76dc9f1b05d76106b44f124c3a94af93eb1b44a5aeaa70ebc33e0f9f904d1cd4c8386b281735d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b0b24dcbdeeeed6d46551d908e6b510e

SHA1
f7b2bad854555746e7d80d0e8db2c146a46eaf5c

SHA256
c41beee9481865c874923a7aae0736a818db718360fc343e0d9c039eea632b76

SHA512
b50444743d2577362f72b714965c14d3f0f90a8fa7315c08ffe3dca7ec3cd9110cd2863a99f337258d0e8aee40fe3ba103f88ae92a9e90b3d07c61e5dd906f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b23c85de5fe6fe4a55f7ad306374c4a3

SHA1
42e8462c4e8527ca87f7e59a53d7c003120bb73d

SHA256
0b198a5e761f112a0cdf51d23524acbbd7174945d30992151b5474686469cf66

SHA512
2750ffd881ddd114e265caed87db23a8aa334d6c008da8ca088c1d0cf95ca93184269d6dd0454cd05a024a7dda285c77f07cef1bb726565d1ba7ffdbbb3da493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aeadb33bb3d95c4f8fe5cc2770e9ffbc

SHA1
00581e8a0ec27b0b72d26aa0903115437289916f

SHA256
c94f74ca81a9d6c45adb007a9ce2a9268dc98f359f6f8dd404411b46b809dd9e

SHA512
fc73f4d5c040430c2e05c1f5009e0f5d70b20e729fd2026c694dbaead2e8984b6dfa983094fce93af8f44d1570ea80c33f111da361290c1c185af56ef73c001f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c465f7285ae0a0173296e1eacf377ed9

SHA1
2501e0fd9d76518eb789725bb9d5fe2c8d474212

SHA256
a2b76719dd91837cc0a01fd00884bdd8247ac352eed4136a4ff01e22bd5b62a9

SHA512
07406c7afd1cca6f67f363f8c6b157e25536ef290228d6889a2fbd65b5e8bfe4d6b2295b5de11aae29ed5abae25fc7cda8f92cd67d0ce56228a7a5090fe073b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
746aa796fd152a483bd2c4737efcdb5e

SHA1
7aef9f90a63343f6d19df88201c771e162b00e09

SHA256
621ecca54100955d2401757eddff55d7da3ebfb567df98b90237f77a93db734e

SHA512
7e3e1a68922e034114ba04770be076a12d01d0ab11f4c1f3c29df6b525aaa55d41a5539fe65040cdf6d3c905bcac91db2e2aa734efbfc34279fa3986ead42caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed4641016ddc86079c3577563e7616b6

SHA1
380d20617097df323731b3ce37b99d130a033d8a

SHA256
2c2f3ee73fe77a3bc75f4de02a0211132a3d70aef7d0cc2d7323a4eb0ed6e308

SHA512
3ec01608fe191fe25a0a3628fa1e4567e34b2a82018aa9f9252c1073db44b24df404217ef55968568e0dabe15370e92f87ef0c2f96d99f91d19fda2a2f752d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
32a51bf48df9d5db7c6a1901a1316d7a

SHA1
32642021826785b73fca95f9af299b61e5e115d3

SHA256
d22e91c10e904f96ca3f516ace785ff0d82ef2142a4f9d32b75c35edf86d7607

SHA512
28f2fe35ae5fef118e0e881cd385d84930058895d70bf26d9fa7a5f144e87799b3e83ad990ee6404ba7e40e6e518eb4372ef2e79b9e57659b8ed286cb5d2dc20

Download Submit