832e166a1d0a1860e24b91e900b1b392046dddff658c772123748d404374c0c5

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c96360c94393db2a9c8cb8c417c536_JaffaCakes118.html
Size

124KB
MD5

f5c96360c94393db2a9c8cb8c417c536
SHA1

c05725af550286c70d47760be6cc8d92bfe1d9cc
SHA256

832e166a1d0a1860e24b91e900b1b392046dddff658c772123748d404374c0c5
SHA512

988e75a6fc53afa48377f50eecb91b6970740d7253db37a0cbd84b7b7c63eaafef8837cd7987e33613df275375f8c69031041cc3cb9ecc54706c45ec557e91d0
SSDEEP

3072:aXLpVBuroJ+NCTQqVoNQj5hbp39h2qQBufX2IS4JiAvi4i:atDurosz6jXp3/uz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
1772	msedge.exe
1772	msedge.exe
4100	identity_helper.exe
4100	identity_helper.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 5100	1772	msedge.exe	87
PID 1772 wrote to memory of 5100	1772	msedge.exe	87
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 4292	1772	msedge.exe	88
PID 1772 wrote to memory of 3004	1772	msedge.exe	89
PID 1772 wrote to memory of 3004	1772	msedge.exe	89
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90
PID 1772 wrote to memory of 4840	1772	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f5c96360c94393db2a9c8cb8c417c536_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5e4646f8,0x7ffa5e464708,0x7ffa5e464718
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,7801777583975534764,9220705943349319665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d94406b964753cc5222ab1343f54bb1

SHA1
a5e7de0781fa1fabb3cd89564f2e5693cb4dee16

SHA256
fd9923a217cd8d2c44a63dbfe52ec262e7c80b1f1e50c6e0f21f8379c90e7762

SHA512
1ad2c144e7bbd809f400f8782586d3768fc82bcef39db986f766897c344efec77ab2c0b6d9c5ee2019ef5cf9ad0c46bdd25392cbc9dbf9ea80e800577f0fc598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
49dde89f025a1cce8848473379f7c28f

SHA1
b405956b33146b2890530e818b6aa74bba3afb88

SHA256
d6d125ba686b825bb22ab967a346051780cab1f55fc68a2f3efdf3fb5598f96b

SHA512
53050344674d8886db66e25f42d97bf46b26229972631f857286c2a303897cda58d85ee8ca768bbfb1fc07e52567315ea85d57e39b5b382916700ec389946506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
504c509e7ccec111dcb2a0736c9a5ba8

SHA1
6af2353a0d05f0c7ba50f0f93d90c241cf89c146

SHA256
27129ac0d6cfe983d48b122664cc88738ca59225d8d352486d680d926e92614a

SHA512
3ee36476c101cc14f23089435038575fd2a86100d2b88afb061728e84d9faa428eef8a81a71c86992096f4b7bd3c0aabf5d0867766351eb1466306459d1d0eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b51da98ddfa3f644026f9f4f2b21d970

SHA1
487a3203c2c4d983636cff7e0761c11a6743e305

SHA256
1dce408b1e398ffc70ba961896fabaa6ca97784a2813fb713c124a0d5072aa6b

SHA512
92128e3c8d3c083160957e00a1f8bb05c26250ec3b80239724f58bb30eb2117e0d0f6e26f8cf2162804b996570e6fae0b40673008c6319fdefdc5d53771b011d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
81b05ea69ea39c0ea1f35391bab2498e

SHA1
48006700b4cf41c56f510c1a11a5e2370c70a378

SHA256
4c7b26fe531b07ead2824fc4d5f6ad4328b9a1ed341b61d922d244002e13d5ce

SHA512
436a4dbd61e9ea722e2e4fbe0a58ac22f1a45a800132d6c13d228f7a446883ee0f81e91316ec51e94bf5623f5735ff7cf4daeb62b68568d0b262ea76f23c7ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
30e649fc4b338197e80f887753d1b1f5

SHA1
00b8caca75995fb2f5f2026baf2f967b1e774878

SHA256
42c60e779ebf2116e8d9904af45a6e14867ba325cfb6ed42ce1e565e3c95a31d

SHA512
f0303da4f1e2064495c5635f0d8508f9ddd3e52fe46fd1ea370daeae2c5c4c92cf40ce2fa78d362060f7db347bd4a8127fbb8efe3a1d4ee833051217bd01a2c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85df5d1bff9c0b22e9f44e880d53fda4

SHA1
fde5b15f45d735a1ff5aa8bf1facdd4a6289321f

SHA256
cb60a57408e1ee704fe9ced4ed8929236d9b77cfadf5aef1bb24a2a8d2e7832b

SHA512
888165fe89a89b26936543801b06d7b8ff8d6c1c987991814ef8d397b1f81cc0c8a8f28d2ee5fcc8c5f0083fe02cddfcb34a65343a005baa48f495520de22c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f238fc3896a7ad35a1e8aa099b80dd89

SHA1
96fe400e53986121eb6692ad4eef94362c4c4cb1

SHA256
0229071e6dced44de51db962a9a8517a468d637d51265130b98c04b9da34457d

SHA512
ff904ada4a4aac6e19f5c33a86dde3351fa9e033cb1d961700e3a5c13e1fc237c3a6b1ffdac0994c1ce163eaaaa08a4a09d973ddca2e54cc028917c19fef53c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05c8e0bfb01e63fbdd60950b44e786c0

SHA1
5efff45a9f9f3e35bd43c6ec8238fa7cfc5348c7

SHA256
626c1ecfe4d2fabe8a97fa33cd952c6200b00da1694625141aa29278293cd18e

SHA512
8ffa035ef41b1653b186fe1277dd784fcd6c8544a17f785f9996213cdd3d10ee3a506416c495909d3aed20b0aa57acb2ebdc421afa115ccfe8fb47fc6e1a8641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7c43199d1e5acf5a31e1cbef990fbc47

SHA1
df7bd524b9b3175325c0aff3469ea7f2211d3061

SHA256
52a6fd2a2fff53c738c77a6385e7e1677f8990781699f78c63d5a4b0fe566d22

SHA512
aae886642b40ffb0676534fd85abe43ab588526b8e952b12a1bcafc73cb05103c76aee4fa32cc18c74af6c59aa1dc84bcda09ebccb7d11adc79fee3bfc93e2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0200b70625437b925f7413531ded92e8

SHA1
6909d8eb61caa3e47947253864ba54e6d24bca58

SHA256
a40cfdce280851e62ddc2a3ebe089d3ae0359dff05f74c8e3c06c206ea07abef

SHA512
93006dc50f1e5ad600c9e87d51704bebc42472cae66757d96d794ecac75fe02ed1aa81c3624c32a51c06235ab5b1550bd2f585e2511843ed2f3d662a6e77a596

Download Submit