514ff01d728f44cc48da0ede9ad9ffaa06bf4b9906d08d61175815de853339f8

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff7bd4671dde846419eb17c8b4ebdc95_JaffaCakes118.html
Size

226KB
MD5

ff7bd4671dde846419eb17c8b4ebdc95
SHA1

693647d5ac468a1aad62fc86edc8e76d1e9f652f
SHA256

514ff01d728f44cc48da0ede9ad9ffaa06bf4b9906d08d61175815de853339f8
SHA512

a92456cebacee58ba698cae4e75e8223389791562e6563d2870833e0cafeebf4ae129fdd2c0d29f189f70e9ef76cd3bba8b1de137352558fff1f279a44927cff
SSDEEP

1536:uZH29I1klh2UYlh2Glh2OnKlh21oy8RzizT0EpVnE2a4vr43m2PE2i9JnsqaYIrE:uZnVURzizTFCm2Q9JpEWuZEumnz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4628	msedge.exe
4628	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
2240	identity_helper.exe
2240	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3088	4628	msedge.exe	82
PID 4628 wrote to memory of 3088	4628	msedge.exe	82
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 3892	4628	msedge.exe	83
PID 4628 wrote to memory of 4360	4628	msedge.exe	84
PID 4628 wrote to memory of 4360	4628	msedge.exe	84
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85
PID 4628 wrote to memory of 5064	4628	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff7bd4671dde846419eb17c8b4ebdc95_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa2e9046f8,0x7ffa2e904708,0x7ffa2e904718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2287612248459811891,6726760097722909805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
86ffc3a33064a4fa7587c47f82cb8564

SHA1
adb39099c709bc41a593616145df86341895ffd2

SHA256
5d10ef469deae6c05b050420651415193277c9d0d5f5f56d04dacbdb3a167a6a

SHA512
d8529e947751299af3113ccd313a5fff87ba21d5d63aa97442c75aea151245960269243dd2821a262396f698059c7636eec8cee3ad66f2a7abd12c415b91623f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
73dc8f97e3ea43888ae020c73b75c6d3

SHA1
416121159f19690b6b41c4a7b2dd8d97a593cded

SHA256
cfa892646d001d6a152bdd567cff5625348a004b59fe60a650a6c3eb05e6e6c8

SHA512
b52e77b13a3975a8032db45585c77cfe4243f5d6911e511cb2e01b5adea8d875341b1c47101d345133ad42e3c43de19400ac106e7eb9437beddbf114bb2c2351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b8580a9e3bb3b3209ac030baf1380217

SHA1
a4078a0ad86cf900d9b3265b98e42693d9c5dac0

SHA256
925ec7a36f5cf314e01f0346d67572612b01f56f2ec3eae5878ee0a882dbcc3c

SHA512
25594908797d3b944d1d6c6f98c598e90b5df38b1ce89109524e24b36519c0e36d6610e2ed317c39137989685cddf3f48c45f7b1e534876ac60970c44640f73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
baca818914f2bb7b2201f8946602286d

SHA1
40529701dc9138926b7031fee35f5106bc88ca67

SHA256
b4623ad94376eb1cf4a6a981135aa7126de96ed0975640c3bf1047980cb8ae7b

SHA512
d38a0ad0787136b2dba669493ab55c1331a8d19028bbf3785090637d9a225ca9bb3a7dadec4f8c172f293ee8e309730223e3fea233ebddfc64df1782d4b91b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ad5ba6cf3870ece91f8338dc6ff1fcc

SHA1
5f5c3a21fc738aa82279766828a13bdc774f8b87

SHA256
0c379aab120c0cbb5ba11d8316c8c61c32e8b4a118d9f35c904395a508009949

SHA512
1a11fe9bba5bc51eb5ab10b221188310c21cadac1d1ddbb2c073b6ef6bf2074fedebdf154d99154787642af8e8dadb8205e758c95130d42c823778720c2482ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
366b18404bf5625a14f5ef85803199bc

SHA1
4bde4fa4972e05b00fe639691993c1eff57c7936

SHA256
00393da9db6729556b27ae34a9f92f0e3721057f37c13113f24aaee3a9e1fe84

SHA512
0679ac68eebf7de0ba8c0a8a692cbae9028181476617e5e3c89e8224b84851db8135a0335fe15eae0978f0cb822f4731424bcf8652719c25cec1c3e7cdd5ad76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01a10ae49731374913c4c920a17a7ea4

SHA1
0f4498fb5f45a7517a65df948e4839e4587d3ae9

SHA256
408029b1ce74b7c3c404b2da8b18dabf0acdf41f190eab62a8f9751b991e8474

SHA512
3bcda7ea499b70ea050880de42e7d0479b7c3a5a6973007c4059345f4d7cf2bc668ec3fedea10b78c55db35115555b700cacf7d285dd6d2097444f5aeed65937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
184bec44c9c0f1735062a7ccdb2cc080

SHA1
71cc3d19db9d2c0f29aba8abeb62f6e99140d220

SHA256
69af824b196f6571b1e7f1a65cbd7ebf2d50980ce4639f5e2719d716a2b850c6

SHA512
ed2f3c9b5329c4ef05be5f9fd2628604b2c1840566643be8e927d9d77a4948124fa4657a6ab1e29a223508fc0ab104741a5df8b665d37de1ef5deba29a05d245

Download Submit