513ee1a19b0dc1a85e2a8a658558d7ca586418eba6723a5e1683a85fda8b5c60

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cd990b2b71d20383a612f40daca1cfc_JaffaCakes118.html
Size

87KB
MD5

3cd990b2b71d20383a612f40daca1cfc
SHA1

22ed3432fc6d2619141194e29d7d703cfedba6f3
SHA256

513ee1a19b0dc1a85e2a8a658558d7ca586418eba6723a5e1683a85fda8b5c60
SHA512

8f229b9fad116cefe2ae76e03d6658322f3043546127f2e1f2065f289f2984b696fb53fd0816478933c162d04219b1db834f879813698dcda04e672f5a1ce540
SSDEEP

1536:WEEBQRpBFjeUR/3IfVwYqiwZv1+N99WeouXxp1d9kSRDWJm:W5BQRpBFjeUR/3SwYvwZv1+N99Webdkc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
1552	msedge.exe
1552	msedge.exe
4868	identity_helper.exe
4868	identity_helper.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1680	1552	msedge.exe	84
PID 1552 wrote to memory of 1680	1552	msedge.exe	84
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 1116	1552	msedge.exe	85
PID 1552 wrote to memory of 2536	1552	msedge.exe	86
PID 1552 wrote to memory of 2536	1552	msedge.exe	86
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87
PID 1552 wrote to memory of 3432	1552	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3cd990b2b71d20383a612f40daca1cfc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe578b46f8,0x7ffe578b4708,0x7ffe578b4718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,1877789846106248708,3408934061326435337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2644 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
8d821369ba5a495d38a74f23aa5430a5

SHA1
a9c6634b71412e108545ff2db9864b873d88bea7

SHA256
a518b7c03a844c963409dea1e5f90a34e1493dde70153671ff879b80e6e7b969

SHA512
6017d80f2e8668a7cdc0bea73cf4b9a1f9a2bc79a2f23626adb97899dac74558985f88a9ca4f611bdcab41fc8f23b4000a2b1cba02b878c8d3d8581d57b81d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e4772398ea0bcc03e68029625e2fc5a3

SHA1
85bc2b048190fb023039091f81d3eb86255f745a

SHA256
26fe4ea80567960d766713bf1aad30b9fe3c430761bf8f2af59c0242c87b8385

SHA512
3ce117111b907c3bb897e879b6942f4e69c73beb61db83d5710898cc0f412a2c9dd6d6a3ee3e4e39c87488263b82e7f5495221ca0efaf9c0fbc95735e2bb5298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
00287ab6913fb1ad5d7f2485888f96ff

SHA1
a429c1978a49052c0877e1e9e383ff27e9926c5d

SHA256
90624dbeb6dfa44043bd3c474a79bb64f28ae315f3dda475c72d83bd62829fd8

SHA512
5e86de64ac1aa87cd0174836488aa084100f4a7ad8c3cee6b42e14f4891ab227eb4907487fd04251bcd9dab6bfe102e72f128f934a5cc5b70c1945399e9529ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5705d6db3c74e4bc3131b6920c73cc0d

SHA1
035fec5be0e54dc40a3c47f05e7547e4b01b5eec

SHA256
033a76275ae7c73c45c7fe2903ec28a0c0e42824e4e041c5252739fe161f104f

SHA512
5b40b3f77fbb141b6bf315c779c50452e08fb0e67795e143cef22a6bd5a30a0b0349aa64c61a5916fa91d9ffc23dc98f028e06d7b2b4fe50d74e9c68f7147cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b4bc4ddd041ad145d697fa5cf1b738b3

SHA1
073456da1ac812f57808557c78933580590fe937

SHA256
2285048a4e0906a2b584e76e7d2d63dbc6e83622d37ec3c91b8433dede193f10

SHA512
73e33478e14180cbbf0949bff398a4e930d489b4458562fa44ee7a4eb9275a13e19f231ae81a2c7c05af5fb8b50b18160e3b246528074ae788785cf97ec5591d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
76d632080218234924d54111ab1022f4

SHA1
6dbbfd7193cd872a73d588a94c64a63f1b2e44b8

SHA256
329dcd9077509baf952141b5e31bc27cbdb817f3c1f750d9935cdcf5fb3a4917

SHA512
149fbb1ee94e430f20d910057df5441d9ddb1bddfbef66d2476a3428afff2e46a3e21962a9fffc1ce9f2723da561c9233ec60dae2e5e7dc069d6f81b85bdd3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5090953d69b95dd861722abf6199a5ef

SHA1
b78a949dd0cd27beda0acceabe521d2d5612a206

SHA256
d15bc5536da9e6baaede1e5b996b4fb3cc812a8399f409cba39ab882808e5204

SHA512
51e8a47871bced7f368f592a30fb02b5b74a68d5e9990463ecf81ca540b9693f60b17b90e54fa3abc1552fe3cab558c6b3b36d6c4b61d9e6a73ba6c2113d8662

Download Submit