bf1fce1abc2cde10b17ac8dad1e4d6b32056066e9b970fb744cfc47ad1c2aca5

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44649291d7bf0a4ee7746354fd0720ef_JaffaCakes118.html
Size

27KB
MD5

44649291d7bf0a4ee7746354fd0720ef
SHA1

929d1bcfc9ee3d86dcd6623850691f165c5670c5
SHA256

bf1fce1abc2cde10b17ac8dad1e4d6b32056066e9b970fb744cfc47ad1c2aca5
SHA512

7ca97682b68156940f4528a4fdda3c1fbb0d80b301b5512601915132decec47c6f1ffbc6cb149aceb2ae945bb418fa11ad56a85edb140130319cabb4353203de
SSDEEP

384:J9AuuuqZQKRhaoWLRQHFleUhhrz2c/863LjO9/Qj1+ZqquD6VjTGixZ6T+TY/bFx:JONLQofFnTric/1K4T5bFMC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4336	msedge.exe
4336	msedge.exe
3700	identity_helper.exe
3700	identity_helper.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3724	4336	msedge.exe	84
PID 4336 wrote to memory of 3724	4336	msedge.exe	84
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4568	4336	msedge.exe	85
PID 4336 wrote to memory of 4000	4336	msedge.exe	86
PID 4336 wrote to memory of 4000	4336	msedge.exe	86
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87
PID 4336 wrote to memory of 5072	4336	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\44649291d7bf0a4ee7746354fd0720ef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2a4e46f8,0x7ffa2a4e4708,0x7ffa2a4e4718
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9370494636782633240,16868347890671027356,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
66bc477dcd9295615c887402dd9e9e88

SHA1
68838eaf88f5f86fee59b8e0be6ffef1888b9ac1

SHA256
8c9bc5f3d5c8aa12050fd0ce3a3ee8a8311f95b6167754ae293d1c5720024ac3

SHA512
c108310606a383dcc53f636ccaf342b9fd42e568f4bc0c7a7aebfeec077110e2f2986c3eb320630653df40722692f703c286783f0aa48eb902a6e015fbb68342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
71ed71a7b5c27c2b4bf11689ab02d2db

SHA1
5009bb9d13540d5615e5393a7757357a36c97c18

SHA256
12c60089c52dc2b8888fccd06c13d6ffdc8f1e83c306cfd8a14a844f8de9fdca

SHA512
0fe376456cb7ae3242858fca4ac1b33062ed915a334744ebfbd18964bdd4967a79576827e29a3d3269d2e5c67f2f4b1fa9d19cbc866d5fbcfa7af4cdbbed44f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c41b3b1807767e792961a7b8822a7d58

SHA1
0bf77e07c5a0ac90c3d9361898e3e316aa71c918

SHA256
88f60214ea2c4e7d3602e3feb0b7dac1cce1193c45ad432ba35d1c753bba4b0e

SHA512
7a380a24c1bdf70db3b05c98b5d9a7add2bfa3b559893c43bc7095d885b075363992339ba992ea6636035ea1a2aac1af43bb771ce9e1d52453893ec0ce57129a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b408b79f5264c0bc54d48b342adab62d

SHA1
4755804c381e732dc79fb308f9c8e8ab1da27c70

SHA256
5a6dad576dc08f82d55159672bfd852971ec3ad2c38161a15cbdd2fc7f18fb6c

SHA512
a7fa48df67e4afb6058fbf0b43c7efa42591d0da3d671e1d435ca7637a8b4b8b28d46de9d3a7279c614ec838f876574f55e2b3694e8e93b7dc8591341f92222e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecb967327a51d8c68b994277bdad85ee

SHA1
cd733bc4ccbb17f7e233f105349f7a8e4ceb55a6

SHA256
829593868d7b17a9ac9576459689eba56759921db512a3c300482a85bed9ce6c

SHA512
2c31743c0b4c5ae61659706af76952a0fb867ba54e82aa2e2ad68375df52e414c86e2c3fc2b2019131d2bf742d0cff81eb4c72c280138e4d3b04fe29c4cf7460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
873245ab8655c32c0b82d06aaa50d587

SHA1
9383f4d525c8d197d4cb205f3ec3231a18fe34f6

SHA256
cf5238264d1eb79b1c498f6044d916b8d39e684db86c9dbaad71add79bd04d6e

SHA512
7be6e87645acb1aaf1ba16b70e082275af26e2e05abf9f8dd5e50d83fa8651d196265909d7ed33d35f845ab769b1641875c6e1e405fc606576d43d31e42004ff

Download Submit