26862e0422cd25e4bc3378347a3e793aaac945dbaae52daf6b730bbe3b8f9506

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c77afc72426113238eebade2b5ef2bf_JaffaCakes118.html
Size

48KB
MD5

0c77afc72426113238eebade2b5ef2bf
SHA1

772cd6be1c8eb7d5aced1c3bd959b537f7f82ca4
SHA256

26862e0422cd25e4bc3378347a3e793aaac945dbaae52daf6b730bbe3b8f9506
SHA512

535ecc1f098a1773425827261ee8c2996c70adafb3e04feeffb8c7bc22d26c217bd160cc0a6b8627f93ec48eb3faa596571e9e7f2c329b8a4cb98c59d3f29be7
SSDEEP

768:AJVE/YcuMXfH/pFFvFEZ0wvfPFb+/aUE11UscOziW/:AQDuMXfH/pFHEWmf9b+/5EnUscOeW/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
2972	msedge.exe
2972	msedge.exe
3644	identity_helper.exe
3644	identity_helper.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1800	2972	msedge.exe	83
PID 2972 wrote to memory of 1800	2972	msedge.exe	83
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 4540	2972	msedge.exe	84
PID 2972 wrote to memory of 3628	2972	msedge.exe	85
PID 2972 wrote to memory of 3628	2972	msedge.exe	85
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86
PID 2972 wrote to memory of 4888	2972	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c77afc72426113238eebade2b5ef2bf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bd5946f8,0x7ff9bd594708,0x7ff9bd594718
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12720953685018719331,12181497273103942410,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c9bd84db700a07cc260aff408478f4d2

SHA1
322d1a7ae7c62456ad057dd9cf520480927c5a38

SHA256
90bf4bfc38b78601e1c1c06657a3cd01cb9ef8fa1bd63276e26715f9a2059e78

SHA512
4776d654dd5daa4f6cdacbb232e6c0ddc778f53b839ccf6e94e98bf0f0abf62354b58bab9d29ce939ed882205af681c98e87e471589c860936acabe7ffc019d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
717B

MD5
28590d4bf4865572e2351f6f3a3bb5da

SHA1
a3d265f62a3f7dbcadafa47b335f7da77699217b

SHA256
2c0aed0ae4a3dd48af7bdb74872de2237d0c10de6ef5dbbe1eced62ae17b3caa

SHA512
75abd8d58829b4430e8369393aa83c4b15dbaaa712a42ec2001d2e71d10726d2884b21ce2c67285c1e5a8b620e550c17626ff4c4d7bc8c4fa60cf33dbd1720f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
482B

MD5
8de4dab618bc09bb63c28e3bbf463c11

SHA1
f1bf11de857e78e8ba0c621c8e21c277572bbc9f

SHA256
7d79d8c72c105ad217a0d867bcba0fe9a16e352b75fba67cadace0616d83ab96

SHA512
db0431ad24c3f43f06199fe142205d2111687076b969e1fa66ad0fe6b7c8cf4ce37eb6fbdf95c86a8718d9b8ea628f4571a4645d167c3669407c928033141b9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
578f41a7f65e5c312566890c4b519ead

SHA1
9c76a22c842d86eae8bad395fdb7b430d94da4ca

SHA256
d4db7d5e418354e1d7ee270ed9a50e191ffb0623b7b0fdb87ce66591cee39029

SHA512
9065624504d445a55754c3a40300796e7d122063c2d8cc888c9532672426ee8e753edfa74cf5de2aa4e2bc4659385514bd53fa3104e5983c9463fc50701a811b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12a541c1957dd1f9f326a231fd64af1d

SHA1
0393ca566b0319f5036ce5512fdad8e7c135ff9c

SHA256
d501b173f58758bbca02a05b9e0ebe0e3fd3126908f7e8a3d0cd424f5c31d3c8

SHA512
75c3ce1991daf679e766369c8764a3b0f6df212bc781a1e257c03ed1d989b0e2bbc8bf082a2b5b5ab6be07173f70abaebb454e0c59b783887d7813d678dd33e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e96295d3c2e5e26387bd315a176af6b7

SHA1
4da76853a94d2ea6782d2ace31e0e62cb17fd7f2

SHA256
30a1dec5a6184e1ceb94573cb50233d92225db46d551f8e62db5eec7863751c1

SHA512
ecf14bc1f9ff3b9633de2c21bc22ee89f291dc101d08dcf4aaff2fe2c7a239b2643ce4e26f332b67fead27fdd8b60e96802d6344a0692fd52db85827eca824bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4430b39c9ff494bf0b6ceefcc7c7d15c

SHA1
53f9e48feb072d27cbd13526d7696832c1071502

SHA256
69f12720d2546cd1af5817f966807e18df6a3ef11aed1e2d42c58c3f36b113e8

SHA512
49b566240dc9f464a7a19ebc925ecc78bc04c9a9901cfb01eacab2e9c742cee81bee01d8de82ef6d696305c55331cfc3a2e008e5bb1aa419d0ac116ef64d1c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
548129785789016afacf1e9ea3dc8579

SHA1
cfa4fce9f62704c581e10a7e151d3159a643af37

SHA256
3ae8d15f70af80de005f15b3d6bb11436f391254b8e827990018c79181f14dd5

SHA512
bdbb25785a51df585ea7d47e724ef7b51198481d7f8c6dd3114827a62bdaa3c2823b3c049bc5cd4927604e75fffffc7ee79dcb15a08eae50d237bd9153849fe8

Download Submit