057ebc595be6aa3966e94f8be338c59468c13b81003ab1b62f0bcc8925791fd5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ebfcfcd5bb6b4eda78691049534fcc7f_JaffaCakes118.html
Size

61KB
MD5

ebfcfcd5bb6b4eda78691049534fcc7f
SHA1

5d974e13c6e385ae07e1513ebe0830d116290565
SHA256

057ebc595be6aa3966e94f8be338c59468c13b81003ab1b62f0bcc8925791fd5
SHA512

a364453527468ad4c50cbf306d3d53223c80ecead625ffb7d596a62963f671d755c491f5e4fec794540902eef98dde3be43d40d259a830088bd759260be358f1
SSDEEP

1536:zS7kAEvhVBQ0qcCOIyEQrAvptB3FvP5l3v+QVUXXV2:WYAUnCfyEF5B5l3v+QVYXk

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
4768	msedge.exe
4768	msedge.exe
1972	identity_helper.exe
1972	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4896	4768	msedge.exe	82
PID 4768 wrote to memory of 4896	4768	msedge.exe	82
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 1252	4768	msedge.exe	83
PID 4768 wrote to memory of 876	4768	msedge.exe	84
PID 4768 wrote to memory of 876	4768	msedge.exe	84
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85
PID 4768 wrote to memory of 4572	4768	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ebfcfcd5bb6b4eda78691049534fcc7f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc190946f8,0x7ffc19094708,0x7ffc19094718
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1156357379199308047,5770710704805732979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5634b87a8d0b668b5cb2e2d75422782e

SHA1
f37fe7ded77a3146730ec5a04356f7d6d1aa0538

SHA256
6441668ca4ef842312295e54ac15c51da3c0afbef6edf8858288fc8b67d6f6b2

SHA512
c36a8e0d090c6af09de56b31e42d694fce1c4e5da1ed8321277aae0102cf1ee00f6cf59c899f8e72270bc9b6f5c8ab059eaf2b70e7e2287fecd6f2e198aee4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5f6f24f1e019336c3b2745019fd36e3b

SHA1
da4f98013a2d03238f0e545ce0131083fbbe5118

SHA256
dd5565458d346d64eac4ebd822017c7d5f0b50d857576d5569b5b529ee24c305

SHA512
c11f24c9bbb2dcbf742b4863acb67ea89faa06abbfae6b97c0b734fba0180ef920aca1082a2e5809605a97b713ecd44c8228931d4caabc7936f6629b37f172ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
acf1837393e334c71fe7fbc8627c8876

SHA1
eb9d8015c9c524e71dc03a4d3c2e898ced056ac7

SHA256
080e9034c84c5e5aefcbde2752dafe8bf9fe037ab736b2de2dffd7d5bebfcdc4

SHA512
ae4a16d3a00f79cfbe9eb5175151b27b3067bcf3b02ece65a0c5a8522fcdc7cdbb5d1fb2c71f76edc24f1380620dfba53d4785966a38990116f7f01f6b564c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
936B

MD5
292907e484a84378f1e0bf26e080b565

SHA1
790c2dd7316abc7359cb41b038e12da3a9bb80cb

SHA256
9bc7cc6d5e2f6d4a1ffcd20e4b9b98802ff80eeb07e86241151d57cb8d7a53df

SHA512
2f7c3c2ed0e5f86d6666a6f9c1eb0078f39b16e3fb568ee0d83758191401986f6d5feafc39355a33042faf365701b481cd78a95cf50c74896707d58c4c213c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
089c0248b61b94573948cf68d797334f

SHA1
a406b42502897dc6e19d7fb21b83610819065f62

SHA256
3a52cf4ace4963488b49e0bb58422daa76b64dfdb0fda7f2b1ad75255b1a499b

SHA512
b40c01777b772a93c253fcd10138e517a21dac61d4d3a09b88f2b154ec53b8ec42305aa20e59f9136604fb9cee9469a76f94370006086a25699f923838649e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23236c07dc6784157d99a4676e6ce936

SHA1
648e76bfbe0d00c8cc997320733b1e597cdb7bb3

SHA256
8b835ed0c16101127345e0b4685b40af1db322021ba0ad5ff781f65c67c3511f

SHA512
82964ca2eba798bf42cbeaa9cbb24df272b6b67cd16103c3678989ac96f741c2ed0780ae190ff7452c45e9860a4b4a3ef57ca5cb02142adbf7ddf90d29986e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7af353ac6a90833e12dc36f31810f61a

SHA1
371d84324ecae61514fc63587fd517f3ce7ec47d

SHA256
9093ee7e653a345eefef36644b1b3d0fa64d58bb5250049899c47308fc75f190

SHA512
b1194508ad257e51408462ec10f370faeab2a4a852a3a9b11563dd3a3907255220f18b44e61ae6370a218772583747d966f122731acdcfc5560d462171fc63bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74a7bcce024bce9decd87ccc8205a79a

SHA1
f1ad55cfa9f1c0e6eb80e8c881968fb395d05617

SHA256
6db92d798cfe2740f13cc261b27c954e8dabdb50c48acb9e6591284e8e377d3f

SHA512
1084961c6a995f873141909d12c2948af8d17c8ff159ef58b0c68bf065647d383bcfe223276aed2d1b13c4b2175a555785de83308c5e70d19ab9887d62db8553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd34a94ad456ab02e45d56b41b31da57

SHA1
bd69226006b5a49f75fa69ed0ce26fb2f6090985

SHA256
fe195bca01077837613a5a6fc0aeab3be0843681e3f8bd8c7592ac04c5afeac1

SHA512
d3f6276a33df6123e931c258999c2d7d38c77e2e05c7c377217d493dbc1d9b0b94dd50c480af3057cb4c328008cde6ba6f66e502695671f5f6672f5f8f518b61

Download Submit