48df1fae07962c1116dfb9809c3c8c4713ac58da753d83047a8b47189f25b6ac

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab36b6af3ede420624a51c95b70e81e_JaffaCakes118.html
Size

133KB
MD5

eab36b6af3ede420624a51c95b70e81e
SHA1

7b9f0c4679988b13e08310216dea111484545c67
SHA256

48df1fae07962c1116dfb9809c3c8c4713ac58da753d83047a8b47189f25b6ac
SHA512

ff6a946562dc50f4f3ffbf9c819ef898488c08574d549854645afd1f2077c8af9ef9403397f54c48ba6106a129c04ed24729b3e2e74427c2c4b1d79896e92c5a
SSDEEP

3072:lFqccJ3g7t2qp4b9eoKFDpxLYJwWb7/UOjhFz:lYccI/FD4wu/Ue

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
1232	msedge.exe
1232	msedge.exe
2948	identity_helper.exe
2948	identity_helper.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 3128	1232	msedge.exe	82
PID 1232 wrote to memory of 3128	1232	msedge.exe	82
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 2904	1232	msedge.exe	83
PID 1232 wrote to memory of 3264	1232	msedge.exe	84
PID 1232 wrote to memory of 3264	1232	msedge.exe	84
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85
PID 1232 wrote to memory of 4500	1232	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab36b6af3ede420624a51c95b70e81e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeab346f8,0x7ffdeab34708,0x7ffdeab34718
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3265518483495184091,15779083048243494944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79888728-398d-4d72-9473-40527ae25f07.tmp

Filesize
5KB

MD5
9a3266af94542c2b7eefb84724c4d924

SHA1
d263e23eaae2159c17326c6f4f5962062c76d4f2

SHA256
a545fb5f7a5f173d05a44cf1ed592a0edc22bf795dedb7fad1bcefdf46215013

SHA512
58cd847d2fb598eb5d241821f22dfbc6c0b6883bced8992fe62fcc9c0af92f78d9fe246517b4dab83e7abba3f15ca579ddc061de3ce37723557daef80b36ebb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
109KB

MD5
8354249a52de108a0e1e4dba57bdb865

SHA1
f6de6520cbdf363f4ad00501e56e7b162164a0b4

SHA256
7af4110ab66064313829166bda677b435e70ed65e5a2f870656362ec13094eb5

SHA512
3cb5ba4469478cb0fdfed17c9ce1549cacbf623690a48d328376d7e3bdaac8cb31a89b9035c97fcf873ec03e9bb544d9d3eb6010654643237e71e2fa6bbc5d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
d99db2b72dfba6ce49671a74f0a4ff48

SHA1
34c2b4e537a9ca9c721ec1efb09dcff6a3db3c6b

SHA256
b08fc4a42b6a23ecf0ede500fbdce01632ee2dc877c033bbd4d2742c952d2771

SHA512
009f523ba014e3ff6d3963cba01560c2b9518af2c2ef7c70697beb54b1e80417fc306897c557fb75361d52d54c18736aaade82b4005f6ebfd8e377c46d74a371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a79bc5e80cd1ee7f085aef85bf1a91c5

SHA1
cb8f8cf59e9ed2673444732338b060fb17cc8e44

SHA256
95d1bdde8d00bf30b490beda6e099ee66db9507c9723b71d9ebe041f321a1e8b

SHA512
0e7da5a81577cfdc2ee9b9c6f0e81dac89ba5bf1dc5bef56a973ffb0295a47fdc59c4bacff597b5b7af8038dae2be26638eb479bda4f6e996852cd19402fd361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e86f76ce817f706792fe9d5e1bd052fd

SHA1
e96c803f107f9bc90a07280d1f9b335ac5f2f4d6

SHA256
4129c41d8081c67504f56750d1d4f4478e2be048a6015b780da226f7074281f8

SHA512
35552364492424bc71d196ff7480f2d1bda347af029c19c9e522ff9bee09d224b18ef03ad10a54e9dfead3368ec3629120bdc6788785cf8eee78273499879997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
555826fa15a9ca8fd5fe45dac6563940

SHA1
76ab687d70dd82ccf8f245f04ea19fcb68e089fa

SHA256
7c51e486a0be9f94fd1fa83dfceceab0b4f8233b59bc08df503069ebc8ab75c3

SHA512
031db983ee7938f9eaa31280f4f74c7ff6d625e3a497ffcdfef8240116055183a2b16b1bda8891feda01e3fab7f53fb0853e254864abde4a29eaa68867953def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
51efac8e2357f3f2c368a6d8b413d6bb

SHA1
2b86ffe4c77277ce9fe4c920ef8018c8fa4fea1a

SHA256
c37a6799b9e436b056beaf5b17f28f17c1d355ed641378173061c465c6155bba

SHA512
1bc5fb33690a8ed655a5ff4838bf5052162a3573ee7676e90684261a3397ab1ba13e991f2177ef2fde1a9b06a04e9fc92756118c201b6c433d8e54d1d85a598b

Download Submit