680252e11c50966f1be8842f5e19d105258e542c9ebd2b491d410eb8fe84b309

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f4bbb61ae202fe07bf2c65d86b1c2b3_JaffaCakes118.html
Size

45KB
MD5

2f4bbb61ae202fe07bf2c65d86b1c2b3
SHA1

f28f78c85077ddc8834fd4ebde3368d02900d7e8
SHA256

680252e11c50966f1be8842f5e19d105258e542c9ebd2b491d410eb8fe84b309
SHA512

7d1f7229d06e41352f2029154d6e69fbbcfb16ad662f9545fe639a728aa541552d39e8b9cff9bbff5f7b27bbabc03c7b40943c90514debfce908babe74220945
SSDEEP

768:h7VuJ8s9uurhp29rt22sBPNm2gppygIMAKq0uzT+WwbrWlvuzsip609o2X7sVkMh:h7VApY1ppyyPTuzabbrWlvuz1p609xs/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
232	msedge.exe
232	msedge.exe
3064	identity_helper.exe
3064	identity_helper.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 208	232	msedge.exe	82
PID 232 wrote to memory of 208	232	msedge.exe	82
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 3312	232	msedge.exe	83
PID 232 wrote to memory of 2460	232	msedge.exe	84
PID 232 wrote to memory of 2460	232	msedge.exe	84
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85
PID 232 wrote to memory of 4992	232	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f4bbb61ae202fe07bf2c65d86b1c2b3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f4718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3137762856963974889,7964566239705958980,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f668db4be35bae6e5c4b964e4cd7002d

SHA1
e94445bdfe29786438887bf4fd2b12a7e114ef7a

SHA256
3e7604274e07f8e509f2ecb5a1cfce746218642d8d85db161a55c23065e3cb06

SHA512
f6b272588bf4a0173cc86bc8ca5eb7d392573a8b619a27b5e3ca512e7f3c5b3907eaa9206473db13d86bce503e2bd33ba3a2139ecde78747ee3e4272377a6f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c3464b92a3a1a06522315ef05d6d3c56

SHA1
8fbd52556b4f5ef15f41ce63bcb5e49e5da451fa

SHA256
7794283e2a53ccbdb23c64efcdb6076e42b912c774ca747af98de5e8bcac71f1

SHA512
e03f03074b5ac4de4d035f357dd6f1f9c41e570a7e9535a0dbd60e6ffda7e035eac82e5a1d7e9dda55a0d75315353e6fab64bc8ff40b52650bd3f3e21543fc05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b7ea16878072587435eff08d10e47808

SHA1
11b3443b0306a1cb3e3b1184f01313e0414f557a

SHA256
0e1c4720ac80bc5de6201fa14746de0983fc4cae6172ae38579ed8225b7b08e1

SHA512
13506bb4423ec2e126c5127e259d6ca118c287dcaca0947a3f7813063f069948579027d7e46065204d2f009bca9c5083a3c20ed4ff5f3d02d21f751d3ecb9161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80690e145e7256170de106db6d88a891

SHA1
8235160321eb9c71bb944a2d80db987eb3a8ebfa

SHA256
f9606bd5062c1e808220a90f8b3d90b7116d8cf4d5ef9ab101bd22741548414a

SHA512
e72195a249d81ee592a2a1cf5aca79ef257fe64c54aa6ddbefd60feadd3645619cc244c6b09fc335e39f958823a5a12574750e79cf4b90a2d50ea7cdaf528ff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a829239a54674327bc842c8843062220

SHA1
f606a3245958a3af7595c86b2d226d6531e88d7f

SHA256
578e3df390d9a4f3556200b74709acaf5ff1ec7d1ffcb5824b17ae20566c07b0

SHA512
01099f8ca9a1856f963a1dd3cd6d862690419a396bcdf88cdeef197780bbabe4f4dcc0282c62e01d2c4e29b6313b62104a0f32b7835a481383a0c697026d7617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b6798769c606a1be5ad8f7c9f41b68d8

SHA1
47ac604a2f49aa2e941c3773fcd87374bb65bcaa

SHA256
0f408a971cb195faa407d692d948db195561273c66e4015e260983fc3e229831

SHA512
d0073616b301ca87588821308f8353c54895f9464c613b3876d6c48930a9751441ff73f4ab17cfc8aed73d67ae8b290edcfefc2560a4ece5dac77a2c1f5e8ef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9088048f3876d2c83ad8290270b03bb

SHA1
2d394663baa5443269784485e481d46695c9665e

SHA256
edd765a865204b65e314751d2e511a56d2f6df326edd3dcc7909d0301767a209

SHA512
8490ec9561bd841fa432b4c92d671c40696f57f7d05b6b0754c439a20d669e356718c22af0638d9702c9d50931d030821fab7ee20e6f1dbfe562cb2864a42e42

Download Submit