79e2fa74ad71ece49a81bb15e9c7573d08a80438fa307e6f498012a8415ac910

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

115137d24f0a12f3953031b931db4092_JaffaCakes118.html
Size

175KB
MD5

115137d24f0a12f3953031b931db4092
SHA1

18023de8ac16b18759f3b9d1b5630b438eace01b
SHA256

79e2fa74ad71ece49a81bb15e9c7573d08a80438fa307e6f498012a8415ac910
SHA512

29ab9772148b38cb5b3405b26806fa1bd0c8fd26f4f9d3c8ce338b84aa5be14545fc1d76fb32f248c0a06f04fd23a169880d408de2abda778639d8fb4eefbc78
SSDEEP

1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS3qGNkFvYfBCJis8+aeTH+WK/Lf1/hmnVSV:SOoT3q/FOBCJi2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
5024	msedge.exe
5024	msedge.exe
2252	identity_helper.exe
2252	identity_helper.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1460	5024	msedge.exe	84
PID 5024 wrote to memory of 1460	5024	msedge.exe	84
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 3280	5024	msedge.exe	85
PID 5024 wrote to memory of 4692	5024	msedge.exe	86
PID 5024 wrote to memory of 4692	5024	msedge.exe	86
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87
PID 5024 wrote to memory of 4620	5024	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\115137d24f0a12f3953031b931db4092_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd9ed46f8,0x7ffcd9ed4708,0x7ffcd9ed4718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14029967828939654379,18234429361885946880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
2a516fc3e28c33bb03d0906f7f6d43e4

SHA1
09bc3fa6770eb8b2a2407f7fcc17618703ee19ae

SHA256
53d51ad0b3685b83dbed4bec31657920ce3a0f8c4a3ce1f2de3fbbb7f4ccf649

SHA512
e8a9eab2f877b7066838e700079f489f69f1573d6bebc18f7c329ba1a40c2cc42c5fdcfc511a3694556b0d4e04b38fc447f6451884ffc0c938225515beacbbdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
ab8670f66c896960b0f1b6d1a57bf323

SHA1
41571b307b3d977fa91a2150616a76fd229245a4

SHA256
197b02ac90ffa3558e62be6a21c38ccf91c3bb5fa0ceed0d0c69639aa23fb78c

SHA512
77509524f3c77bcff3be9122c12fd4781d7bc5a843e1727036e9fd9bd25ef876ff6abc89544decd74ef0c8451fd7ec6ab6d9d95432f07b749e899c2d4a869620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
84290fc69bd3198dce187505c4e02e38

SHA1
9637e6ef0329a5555a90febd8b20ff930d38c91e

SHA256
e7f264e4d9a4a9380ed5060bf28f3d136e88fec1a93af5def01115d5cc48b535

SHA512
506d38df2084a04f5c2c5aa9fe2a6371d576012555f713e8422b789617c99fb9fe6de70a3831045f4f328efd49afb8b49683b68047411679f6ecb41a2ef15251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b2e0392f5b666cb6f5649a85d58172a5

SHA1
abbfc57b13de2ab2b751bedb7611167dfd53e9a6

SHA256
f285f41f4d989a20c6f648c05570118a2acfb6ad0435ae0a822bac6799a06015

SHA512
dee1c29a4adbd7d55d030272d75d8e84f64e9014584877928ee932d5ba6d59501cd55da66fa243e65ea5db4465a5fbc4f46bd2f4c68fccb3a937e9de5786a2e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7caedc2c79c4c376eb3d596c8a5a8624

SHA1
7a1f51b165a38293596bae8fd98e120a7dd28bf1

SHA256
8b3e9228d3adf07397093fdd0b8ae4640b91c9946292b5caab168c74e1c4a3ef

SHA512
4d19b7cd2c130889526383d46b3c394ee0218de39586dc80dd5c62a9b5101850360d05c000aab06d2408cd24bed638b7978c6abf06cd9ec303b0f22ea70d2fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a03a2478126f8e816b54615f5b47185

SHA1
328384cf15dcf8f2a6eeb6eae6c5e34c8c50d3ba

SHA256
ab120a7d51932ceb3ff55a93982136c8fd5b23c8702d620c199d3deed72f59a6

SHA512
2195f527d60b1c1da9e9ace50e9c6a14925b01a983319217161f549f410252753b578b54164c1f3b2cfe24f6fcb228d434cd7edfd740cba9829d88313e767bd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3109d7a0322b92989ce91c7568bb3bd7

SHA1
d39de2964e4a70cb295a61f5cecaabdd69edabef

SHA256
bfb6d6440e04a4afaf6826f55c82ddadfcd8229cdda2474c4858550617ec3cda

SHA512
0541aa67ffa94022a1fcc6c1642e27fd4af3da98f2123c1225a6b13d5e908c92691615c2413968002eecbc898b16ee11ce52fb3abca0b22d39f7b26aefc6127f

Download Submit