97dc13ae478c68b02c0c39429bcd678d8d5e07a477c9082bd9c2428f00ad39ab

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dba5b1925da2c3c7586cbfa6a88d4fca_JaffaCakes118.html
Size

58KB
MD5

dba5b1925da2c3c7586cbfa6a88d4fca
SHA1

2700f0d96b78244b3c136941871410908283c206
SHA256

97dc13ae478c68b02c0c39429bcd678d8d5e07a477c9082bd9c2428f00ad39ab
SHA512

7c89bed102bc493ae7dec42b215ab724a628acd1e692588355d0a275139ca688596a9fac8daf5d827261633d041197e2fec32f3a92b6eccde37467edeb5b63d9
SSDEEP

1536:CTupBTf17Tp3kSOxqkdOjijeO3Mro8c6sA9:npBTN7Tp0JxldOOjeO3co8c6sA9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
4036	msedge.exe
4036	msedge.exe
380	identity_helper.exe
380	identity_helper.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2072	4036	msedge.exe	83
PID 4036 wrote to memory of 2072	4036	msedge.exe	83
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 3176	4036	msedge.exe	84
PID 4036 wrote to memory of 736	4036	msedge.exe	85
PID 4036 wrote to memory of 736	4036	msedge.exe	85
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86
PID 4036 wrote to memory of 1860	4036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dba5b1925da2c3c7586cbfa6a88d4fca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83db846f8,0x7ff83db84708,0x7ff83db84718
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11025827681284321232,17705953901834431067,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
e1416b3cfd97d1fd54be8045ebe8e57d

SHA1
a6fa2fa97f4bc083fa2fbc9f5c8f81b93b976323

SHA256
287af15bf26e6f4236de7bcdd97d12fdb8ecaa79d08c7c2f2ba55de862dc0b65

SHA512
6feac33f6d6b3615a4b9ee5a9c5c17c96d36870462b79a1889c6d175008a2495ae7ed2b294e9c1d5e5a5c30bd1b6427d2ffd69f58e42a9ebc5b8e39dd2ec3acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5eca7dd9ec4962d23ae99e6e5dea380a

SHA1
8fa0bd0bb45039795f1ab0af7da828b30c704e63

SHA256
73b36a22f2468b2941233c787188b9f538a643e1579d0f356e8c27c4e6474926

SHA512
e8b9b6fa2bbc5fa0f8f43551fdb397b2ca236c2e096646dd3ef5e4955e44741e5017d5782bee78fb672846e87dc3871fa45fa5e466f0dac9c529dab1bfdc68c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8840e3e314631c71c933091689299adb

SHA1
a171896626a32807ce281585e69e7ae95beb0ac3

SHA256
ba4ce0a7f3a3e9d9b9923425ffec5c50753cd8e13e1b0698bb271239ec9d4ee3

SHA512
36ed708c0921e52f33b3e0e2ac1086a7086be98f000ae1b7df5cfe3b71f77aeaee2812cf5ca421264d4fa9f160f6855e186d8bfbac46760bd87dd8ecc0161f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d62ea2d5d516c1df38f6892fa5016e9e

SHA1
a18bdb2edef7550bc9bcf562a3d86a7f5444aae1

SHA256
93f56f23b42773c5b0099274649159ad4cb404b2eac06bd11173f0d7b0f5d885

SHA512
d3a08a068c0a9f1cf5ce2dbdb6a929f61305654feb48caba1f83a22a7b4d5f9bfaae72f69a8759a2ceae7870faea534c24bef7de671b2b461a2e135362bb0468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90dbafd4c2c597f970e8f22d3e1225bd

SHA1
d6450985dce95d24899835763fb9824d878cf10f

SHA256
d8407153ace3de6773c3ad30674cbd6e31a6c2c8217e1a07b04bd992582b59ff

SHA512
862b4adb0ca6c906ec723367722a69bd4e635557088b3eded895e03b3e067b6d0897f5d12e8449e92625f59e8636c798162f0dfdea79dbb01f0c5dd935a5a56a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d60b12092be506b4c4873a0125479fa5

SHA1
343ab06acfc44d7958533007b20bddc254e114eb

SHA256
e4fad005e3294391639759001d41bf75731e6ff9b16fc26918fdc088811916a7

SHA512
2a451be8a5ee3d6c049dee0d1eb327e5fbef0e5b19f69e52347d77f68c4da35143e0018c5963ac67b4bb0117399943939fe9ff707d3ad10abddf70f8f5fe7c64

Download Submit