f8001ef7987842f2dab287212d4f00cf4beb17b58e5bc7375265b09c585347ff

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12d538d285299d1d5b87290875aaa01b_JaffaCakes118.html
Size

175KB
MD5

12d538d285299d1d5b87290875aaa01b
SHA1

1bcac5b302fe4ac3eefff379c5b457930be5bb5e
SHA256

f8001ef7987842f2dab287212d4f00cf4beb17b58e5bc7375265b09c585347ff
SHA512

89eaba6e7ce78fe38c0074bc1c866e701521e846325185961398d7df0b33e24a7f2f12513622332eec12a6787b12fac2e2673972befafe201a6651fffa8170ce
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3DGNkFGYfBCJiZVc+aeTH+WK/Lf1/hpnV+:SHCT3D/FPBCJi5B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
2220	msedge.exe
2220	msedge.exe
1736	identity_helper.exe
1736	identity_helper.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 228	2220	msedge.exe	85
PID 2220 wrote to memory of 228	2220	msedge.exe	85
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1724	2220	msedge.exe	86
PID 2220 wrote to memory of 1740	2220	msedge.exe	87
PID 2220 wrote to memory of 1740	2220	msedge.exe	87
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88
PID 2220 wrote to memory of 3436	2220	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\12d538d285299d1d5b87290875aaa01b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff873f446f8,0x7ff873f44708,0x7ff873f44718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,9067854819223491812,7223043438273729849,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
150a35650422ad7923d8e1f8d5e7c905

SHA1
8682d4da4c2ce7a0c602635f7c067bfe1825fe5f

SHA256
adb3df918e97737130e351598f5cf4fe7a65dee2942fc33886dc301334c0c941

SHA512
34775033034aa2bfd67f730784a645b53a7227d96c2ef2bc0234ecba4d7ffbbcb1f151eea5a5ba6db7e2e4135e2f9e81e2f7d1f849fc6a7b111f5cadd887304f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
8fc03a51eb9f6e84627521372d0348be

SHA1
94caa8b26bbe3ddba1ac8e36c856a88456c8119b

SHA256
2c1af40c06b5e61fedf9ae9e98cd7d763a02d77787e1d305c756514ed027ff20

SHA512
cc5781a3f28fd9959f0ebfd3080bf428cafeba9765310e1dbaaf6e5a9ee1972803e1a96f184b84e7d703604e1b974b00fa8bdace5a37fc105f8b74ba64547c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e83743998d52d103abfa916638092e4d

SHA1
b98063d09fecb2d1d23255b196a8c873344a90f5

SHA256
0f03fd5d839606cfcb25efc248127ed824b2e8d9333e91200abe66706a8bc115

SHA512
911128a99894bba5f1e6a56e936e808ccafdd83702b650bc10d5638b6004546092af9bb8e4349ac3e2c8b929db076bf98cbe209053eb69f2e069d812ac7cc685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2bc16b06a07de830705ae4fee890d792

SHA1
d779d45b6c80dda6949a9fae282861c3fff089e7

SHA256
28dbac90c3c6b0d1b363b33f41929e8c8cb4eac0e54782c40975a070d1e3bc67

SHA512
99d355388c945ac6171b8d0c799db1ac2da1ba3254064e9cc6756091d8308c27c310d101b72d9afe3a44c1181c9b829807bd5368da84aa10d4934ae7ab678d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffbf0d110eec902b116a7e6f8aac5938

SHA1
4c8db724e6277904390039758735181d4d612534

SHA256
2d6d88e9dc2195cf9cf0312c87465a03e392f2922ee85ce2b7607d628f3791d3

SHA512
25e84cccec7b4caf4322c5bca165847256ca5f293eb61100ea230f03277ad484b4e357bb1c5006555f4482dea839129768515274cb213a10932e56ef37b650fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c30ed22a3ea43542b224bdc57879a955

SHA1
1e3dc31041cb33d50f82b7ea2c9ed8aaf3934ff4

SHA256
f3f68535402e817c078f3d7ecb537170e366aa437678df1ec8a797c56cef3df9

SHA512
b3971b784e6b719ab9d73baa51bcb845b8e7e424ecb30b2e60c97e8daf4831345d3873d333fdc795e005210be89400e7c992870e2aba8155600b6a901a4fc5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ede7163574743b7e04054572d6d2861

SHA1
c086f6f91820ab9896a4d1153428b7dd408ad0d5

SHA256
ff728e102e6ca687f6d16605dde545e59fe8ee2130fd7fa4a68b487bd1112a58

SHA512
7613de2ac3e64501869d6e06afcde478317a13b51795e6998904779b1760c74861e8dab4a747c91635c62bce7c402908ee3a11d3d604e9f97691267c4544b31e

Download Submit