96b2ac1c12e26dd942d8aa33a4bcdf2854edbaf39a92a9d838e3e3ca653f456a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4f705341f9234e7511e8e662dad3b9e_JaffaCakes118.html
Size

89KB
MD5

d4f705341f9234e7511e8e662dad3b9e
SHA1

c47579edbf6cab1f488dc8112ea1e7841cc51624
SHA256

96b2ac1c12e26dd942d8aa33a4bcdf2854edbaf39a92a9d838e3e3ca653f456a
SHA512

d22882ae27bc3a1a9e1f55c719e4ef7fa00a0cbef88b28d20df1414fce6c9dc2bf6c1c08e87ce30be22f36d587c9731910a5b2bd403ac94064187a4e5cc138db
SSDEEP

1536:obOOs/biOSx4Bs/biOSx4qkg3GUzBYjxlYwWqGrPmYPv9rCX7CesIgs1ld54wJNu:ohoDl3GUz2xlJWqfYn9rCX7Ceas1ld5i

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
3356	msedge.exe
3356	msedge.exe
4468	identity_helper.exe
4468	identity_helper.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4544	3356	msedge.exe	82
PID 3356 wrote to memory of 4544	3356	msedge.exe	82
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 4228	3356	msedge.exe	83
PID 3356 wrote to memory of 2268	3356	msedge.exe	84
PID 3356 wrote to memory of 2268	3356	msedge.exe	84
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85
PID 3356 wrote to memory of 880	3356	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\d4f705341f9234e7511e8e662dad3b9e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda8d446f8,0x7ffda8d44708,0x7ffda8d44718
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8163267579844333114,9827679969003901605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
41KB

MD5
9631c594f55c395f07b12046cb8fbf9d

SHA1
cd6532d1689166c19477923c73083eaaf8cd21e3

SHA256
a56a5d0f5f612bd39fb02fa1ff7a721a33fcb841f40c48757381b3b7c4a25726

SHA512
5d3bada46dbc583755c279b5ff3c155e15f16d51b6522752ab289bdb62b71abe1d91def5733ef7e77fc01d127508d07e2c67e731bde26a478c4780c8918ba105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
e532ac2de4324067c6710a84730f8f32

SHA1
3b7e1ced0083c18aef52c86f5704210a9615cc3d

SHA256
42921ed27065620d54ba513cf83fb8d36cd5b8293af5883d8f615fb6d3953b70

SHA512
517e1f8f5ced087d246e13980c9eb3a1fa74bfdc8ed9e468231946db84f603e732fd666e10d962b024fa7776ef985d57aaec3c54d52187574206600023961fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
417bed97b4efa58cb8e8f45086a141d7

SHA1
d0498b2f17c1008e007fefc84df42d6e22da1d19

SHA256
a861b1095d026b5a19ed2690ec1e6949e536f01ff921a6f86604d7b5d3c66039

SHA512
cdd8b4bd3a56663ccd6b1fc48ab04556af4c684bfb08b263c439353f2edc4aa76577a09ae01e8ef0cfbce7758f1d3ab18e2d4b9e079bc16d0e26468a43877ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0937456b8e48520c0fc83d0a9b62cdf8

SHA1
96cb5f8c46b9659d35399cd55cfdd31927d720ca

SHA256
c2e9016f5c23ce14c93d175e097143e8d3ddcc2ba8e39d283425ab9913e7f314

SHA512
fb2d89028db3ecc491c783a95bb45e3985372376c7994595d7c6aa73a800ffcafe180e49d117bd7cea66ad06165bce120faf77b5f3abc0f3a90fc715f175a318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed63537929c25481044c9e851766cf9e

SHA1
38e5f158e20a3a66ddb1359d7c5f08a8242bf32a

SHA256
17a8f7179aa81c3df341d733eea1069cd2c3d03c226becf1f95056fb387327cd

SHA512
c4d55f7e76e87984dc5095038c9c7ab6f4f4e05542b1a8f50756565064f0832d8632669d3d322b720943916782595e2ff97d0fbec2ce27bd61e70f239f0a4722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c4e9da7c26e1dd57d85188d921e99c9

SHA1
c5077b0331ce1064f369d9912c4439e4bb59927e

SHA256
ff3513c6d0936f3d4ce8700bd848a997f4696dfe7bdf92cba2fabdc4b5644ab3

SHA512
68b64b79cd8a6abef0c29493855ff9d3241a33bc7477b4f8771797a42fbe0ab334fe877be2999cfa34042b0efbcbd02b4444b9a22a8c47bf3ef3fceea896ba8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69f3b81ceb739ea32fb6251c06757858

SHA1
235e5d2403075369d9a34739045b1cf5d0c1a0c9

SHA256
830817c6dc92a9f3daecdedcc206345396970084cbab70dbda92a29fc2ad9a67

SHA512
dc4f626fb4af94d017554e0cf4b13bc66eba4c4feab476498489008fe6c3f584f59e62b698aa565913574144b9f5098da3dd9c2a2741527a718844d190050f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fde1a5588155a743a5b6315fae4eb957

SHA1
c97fa46ba11bf525eedd957fc7486165d32ecfe1

SHA256
2dbb5e9076d9a6c38ab036ba7632cbe92729545f319bcf803513a619960a55e2

SHA512
814741c9154492b4df1a2bfa163cece2d1b81ae24b405bfd49291289f2bb743437823b1d028c78b947059d825e40e8124257c599cf0497db39b71e0652f018bc

Download Submit