5570f4d395bb0f5ab73fed185e783d05da4dfb5c9bc44d26c87bf1bbde728b1a

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f1feabb4684863a121c277cbb6cfa97_JaffaCakes118.html
Size

44KB
MD5

1f1feabb4684863a121c277cbb6cfa97
SHA1

6b5c1afb94550961c8ead47670acf55686d4de2c
SHA256

5570f4d395bb0f5ab73fed185e783d05da4dfb5c9bc44d26c87bf1bbde728b1a
SHA512

bbd7899af605b99570b13300f7064f02c21d8c3edb115e18126b84096d11288c3a59f9c2b8404ed512dc5b7e2cf4a46735c9ce14ff5b24485133f711dc85f62a
SSDEEP

768:kDY0g8FyEaHa8+D0pUjLyuAX84Rf15WigwE9O/JS:ksmyEaHowu3F4Rf15WigwE9O/c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6056	msedge.exe
6056	msedge.exe
4976	msedge.exe
4976	msedge.exe
5708	identity_helper.exe
5708	identity_helper.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 5952	4976	msedge.exe	83
PID 4976 wrote to memory of 5952	4976	msedge.exe	83
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 4920	4976	msedge.exe	84
PID 4976 wrote to memory of 6056	4976	msedge.exe	85
PID 4976 wrote to memory of 6056	4976	msedge.exe	85
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86
PID 4976 wrote to memory of 4572	4976	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1f1feabb4684863a121c277cbb6cfa97_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb718546f8,0x7ffb71854708,0x7ffb71854718
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13308978724111795782,9351634343534058068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
e12012f2fc55f35faf4f7f550b3cd3fa

SHA1
147120ee3e8c69dca213a7eb1215f68d26d3961c

SHA256
58d48c51061ee824e9bbb2527455eca2227e4c4de93c23c8598076ac9135b0c4

SHA512
3b5059ca4f4d8bde626e7d62a65a3a2c11ae1787bc8e9085494e9c03ae0c454cd839e0cf0609264a7d6d9cba2b96f636c2d86dce7b8f634e8053981aa9cd9cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
368764541a417db9a4f03053228eedb3

SHA1
b9a8aa5d7b04d13f564d7d113873bde44050abdf

SHA256
ba6b19524e0395990461326791842e93b03b1df29518cef9b3873dca60ee1368

SHA512
f40f426d962a8036286fd17247912044ec72e40781c6c73f8f7f04f51dce1086e6b1209f6f932f8401f0f613da4986a471937aa22faecd28c7c942baa754676a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fa292ed331d4864c14629ccefb94c961

SHA1
42b8e5dc59887ca438e30381a19ca76230cad415

SHA256
6a904903b84908384a46e9f4ed3b35cbb1ac637caec4a8453c1ae11a1b46fd58

SHA512
037855c4e2760f86ed4f32c7035063c451b48f98f1b35a2a2d7589f1d760fbde8ea783208df0d289a8441ef88ffa4a0ba6391e39a6bc95e192cbcea20ec6b1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
92512c307fbaa8d8f700e067af93a9c6

SHA1
ac88ad33617a70e8310a31584f502ed9c4ea3efc

SHA256
919d90dbfb985d0f132b4662724021fb746f6807cd8982f8ae5e407c1f92bd95

SHA512
8b15270d60c0851c4066fd6fb2b4b7cbbba054c37c186ab7c17be1a8f7915497fff7a9a726a00425279d504556bc91da2fa2e00280cb26921c55252159fd9f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9280bfb5aacf861e99db56b49cb69554

SHA1
e3bdcc8fffd9c3374716a0a753d69a30e327344d

SHA256
9c789aae4d7533c12e3ede50c41030103606a7110877fcda4818e2a34af269b2

SHA512
e343260f5819e45ab4819e20361f7eecc38903c942ba02a3be0a6705c9211c236ddde02996c1faf9f8a49b5ca8a87cbe4866b1fec7e7aac39ca65658c1d40d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
db7ba97ca29c1c3ba7d513bfad5294ca

SHA1
6613bc5213a16260897c81fcec1af9c90360a71d

SHA256
716c82079dd456aaf7cb36c08994e7e5d4c16c38ca336dc91ddd26f3ef4a6645

SHA512
7f1c84e1b31aa4fcf315725138c8b388415a8cfdd880eeec8325215efa0ae28062f64abca2567826e6805002840a04f25c1fcf5bf918918b87e68effb94b74ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7fa25d1e5649f3144d14aac2adcf5d8

SHA1
5e22128326bf7de42d21c9f20cc4506534f65ca8

SHA256
12df33e2db14bf41b1a62d6f7d9603f962e967c096e34f0b97430a43f3a6d494

SHA512
57a1523e2830c703445093d6af9416ed19ae2e84863ee572def1948d83180f8dd5aa61cb53c2722d9a684d84394efd8d460be315b4f855fa93631461a3061868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8bfd1ee4d6b331565fef31998960cf8e

SHA1
eb4f644f5f4c8a1e920d733bca8498e0dd4d664d

SHA256
74f10101cf2bc4fb4c6a2f6fbe9deb49a7c639496ba7cf8046b0fa89c73f79a5

SHA512
09b152435e533590847291ea55940b3b2eaeb869b08896f9cb603d4c77136d370636a96fb3b7a65724c5b9f81065bc6f8e7f827c83475522853a85d3d893e669

Download Submit