25f6f1f6d4942cb85f6f222609fdf43e2ae3be3e68f6c6adae6503ce71660dc4

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa4350d7d3dd0b91ebf29b2f60140b0_JaffaCakes118.html
Size

24KB
MD5

eaa4350d7d3dd0b91ebf29b2f60140b0
SHA1

913efd549d489aa1d0858e3e21a111ddb34ea7a5
SHA256

25f6f1f6d4942cb85f6f222609fdf43e2ae3be3e68f6c6adae6503ce71660dc4
SHA512

d82b863d3bedd8eb24d97a13cd0046563aa234788400081d0e0044cd6d2d834ce7208733881af75da333cff14b3dd36310ae045e8e7773a90044849577f79b52
SSDEEP

384:SMc6ziYod+JyzHAlu14P50kPnqQuZInTKapBKdrqVDBI:SRdbd+JKHAl+4PHPqFWQWDBI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2188	msedge.exe
2188	msedge.exe
5100	identity_helper.exe
5100	identity_helper.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2636	2188	msedge.exe	82
PID 2188 wrote to memory of 2636	2188	msedge.exe	82
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 3628	2188	msedge.exe	83
PID 2188 wrote to memory of 2512	2188	msedge.exe	84
PID 2188 wrote to memory of 2512	2188	msedge.exe	84
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85
PID 2188 wrote to memory of 5064	2188	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaa4350d7d3dd0b91ebf29b2f60140b0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81a2946f8,0x7ff81a294708,0x7ff81a294718
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12824454783879303,18296736253555587316,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
144B

MD5
33547fbe7071cbf77436b73cdfdfa861

SHA1
4414c7fb07876789bc69a4429868966af08e8f8b

SHA256
cfcc4c058df7e3143e786ce069dfe9dbeff78c3d11aa33ebbd63c108af0a4f25

SHA512
1cf2c44a54f3a4ecfd39b7238ce4299b7140fe4a9fe8d9edce6c042f41ca4bf4083d2ba350a87c6d3022f63416f1695ffa8a40e05d007813e5e4317b6a461d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f93d4e90ecafc71775b7177c181bc825

SHA1
14a8454328a9abcb207d3d9ffe822267d180b342

SHA256
7b36e05c1ac8e815b203021e56e6987b4025c16c3c239f6a5f6803c9547acad4

SHA512
364434ac080e3d9e4da0e47963779f49e95034ad40b9e32d1937f12508fd429a2b2fffddb64bfa4950991fc330cd66b451cd642be716bbc4d16be054b5b60a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
421524cdb9bfafcb28e8e03a1d9f0631

SHA1
f105c33d1846e498ada938330166aeb1e1240b10

SHA256
274f3bd0c2024f8f5aea4cb0a52539a3c5f13e689bd806e832ec5ab46ed47d1c

SHA512
391af3b18d759e80c8d9fc893bf81ce8640c9cd0be70374e7fa2fba782a8465cd1bf7acd8996e61cc8b8d18a861038d753ac56482b20acf8f2f333c70b93ee05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f48e854c10404c0a724f4aacf38ade5d

SHA1
8fde1656a0ac048d0fef10274b03831effb60d29

SHA256
2973650174b10909c9d308f3021c80f63dda4b27d5d6ef1671f52f10bfd6a1be

SHA512
fdce838aa8d7a1302294bd07749e758e869ccb58eb02a3616c039c1e5212b1028ba711d2cd81a337d2897f7712eb89bf841c8828190c770da802a28a4c243940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47e1ae89378d16fe63bdc9b00851fccd

SHA1
b1fc3322f95d41f0d14b6771c7ab570c9092ea3a

SHA256
87deddb22931ab6735c4bd0ad919506a62b646f5caf17783f935df14c7b49cb5

SHA512
c730d3e226f6e667468125d9bbab4e239e9b447483d17a47806dc5980f75978b919350ca7f5e80c5b5bad17ba6b96af59600600f8da29fed5523bf2d06adb7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce41358f38d0fcb66f3c7c1a7ca62ee3

SHA1
c6742de726d902603e8ff2542089702bb223ae95

SHA256
ccb63ac2eedce4fb41de80a6fcca0111a98f1a0690c570839ad3edfc1f825f4d

SHA512
29a5f72e8d6117706c854b75832663e51e19ae5d7dc832845d5ce56d37ef47b218a088262454e3923b99071972386b27e2684384ab46b28b962950070b8b4c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
32293f95fd1f8f1d536e75d01494e865

SHA1
f13590499d2c8adc7d2a82990d9296502898e23a

SHA256
caf5064ae764e2eae9df0158f6cc79c1dadf0b9decef9e318e89eb4799787d59

SHA512
8b68c7518ccbc23160f01e5cf51237309b0b3fc27d47c7a662af3b487678123a493ab3b585dd4520e1af12f5b822b50ebe1ac169ebfd7fd9abc4da54a08647f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c04821136399630570758fe49f57ccba

SHA1
d3c32e5faa9f5e168634babdcdc6d0cfdfc71032

SHA256
b99be1811832478d9ded7f410bad59cddc3fc2d0ea19bb92eb3a99d4bced085d

SHA512
2c0bcd8caf63f9ab346222ec55905b586e2041452936dc204d0589ee6612a75a573524e58969d51506f1b4ac487e9004d389a5ee10e5880da9fb95f5a9c7ce34

Download Submit