075ecba94533bdb6f2fa8171e308f96e5279594419bdfaf8d2bc1ccf3bd6f495

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6131767e0fc0e2cdc8181bb22e0e6ef_JaffaCakes118.html
Size

36KB
MD5

f6131767e0fc0e2cdc8181bb22e0e6ef
SHA1

dbaffe1f8b366674f9a742fe9fc9435c2d2df987
SHA256

075ecba94533bdb6f2fa8171e308f96e5279594419bdfaf8d2bc1ccf3bd6f495
SHA512

8bf251525487968eee4c57dfc27ca5e1768a41b5a654f7d7fa09aef262e19ac8f1abfc953a771a67044ce17974f0acde79423bf798302d1f679a851e9501478d
SSDEEP

768:RPVpdEOcypQtUpDoQwYkm6RM/O+whkMyRoM/dXRr3QcFEYlMDhpdbln7rpddja0P:ZfMspPeX1dPSJ/LMiWo3A2PA33nLzaK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
1104	msedge.exe
1104	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1788	1104	msedge.exe	85
PID 1104 wrote to memory of 1788	1104	msedge.exe	85
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 624	1104	msedge.exe	87
PID 1104 wrote to memory of 624	1104	msedge.exe	87
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88
PID 1104 wrote to memory of 3768	1104	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6131767e0fc0e2cdc8181bb22e0e6ef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b904718
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4485141670790950451,11794823492774305698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
29e4db2ad235b9efe820c07a9854a593

SHA1
0e8b00abc9e18e48483e3736ddac7e2dd7ce2dbd

SHA256
cccbc2300c19cd21f8503a9c8874b2978d26541fe9a3aaf67b5d341f91fa90d6

SHA512
cfa1eca6da076459c774764bce11d7a003066a0db89008745b474265d92e819ff0b74fbb48e1f3a50664643e2437fbad146c9555b8d52a1120a261a9fef392ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2fb2adbf759115fddfc218427ea7f08c

SHA1
b002920bb05b91828b973cc606f7ba3a77670fba

SHA256
d18eebd9a16b634f127a8418da46fbb0c5515ca08279ff43f27f69ef69a4482a

SHA512
24e1e648ea7f8734f6ec6011c5df2b0f4df093f5bc9479a5529bea734c84e5522189e0f374ce954b240dbff0b2decacb298a39afa976dc1379879782c417a40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6f654ef6a6beee977a21a69414258e8

SHA1
0aca4ff490591b28c39f18af74d75ef12e223fab

SHA256
c8829799b68179f56e73f7d44853be47068205c92e9ea265d0930ed013557ca8

SHA512
eaf038ce5d6b276a7fb26181a40ec9d351dda4ea6af0c4d92ac070e93c400bc8bafa5774c563f39f53d1d07552ee44cec88a1cf6eba6c75b652d5e890370ff63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5918e3389b91ba27079dd6ce90842439

SHA1
fd077be18823d277eeaa77133f4ac078695338a6

SHA256
19d630200e2ad256a4ca60abba1a0a2e6b8506ab2652df46a86eba40b5f0adbe

SHA512
bad2fb8ae1099af00843eb1ab1a999003231333a9ad2f21627fde41f9d5f6e83fe84cb0d49bf5f07b694a85d6981348f8dfc756977d4b7907717e282f6d0f24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
873c3253df72f5f4cf5bcc7685515e4e

SHA1
505ca0fee3b54f1a31b0018f299f439f15eea0cb

SHA256
434f31ae3b05518f5da3b3985d308fd333d12ec6275da996d42168c28948e3f5

SHA512
d59abbf9eca031fbc948a8475aee6de3e0a9b2fc3393c17eb2c7975516757e069e083a2742638fff0193cfd8870b31a83383e35a15ae21a119a49ae822b9981d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cf012b9af75a792bb335f0a09decfa0e

SHA1
2a9c816584a21b16ce70502632e9b7bd142c36a9

SHA256
27a450b9ba0bc4992cd988fdadc5d5d5c43e9c48c8979774d91f499896251903

SHA512
c847a9315ebb21788f26a73814aa2d6f3f26cdcd410172756f9049c62039663f535b8db88e78748e1c7de75fd7a5586cfdf0dea387c8395bd8f7701af820b89c

Download Submit