2359a4344cb0e4e3bdb990fbea46f9e4efc3bfd9795bf00e778ad2f4fcbab7e0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34c6410d175f417559a07331b573eaca_JaffaCakes118.html
Size

175KB
MD5

34c6410d175f417559a07331b573eaca
SHA1

c4ac924e493e55e8dc62dd596aebfb4244fea8f8
SHA256

2359a4344cb0e4e3bdb990fbea46f9e4efc3bfd9795bf00e778ad2f4fcbab7e0
SHA512

949dde98bb772c90aae05bbfcc4fa5698f5e20c6fdbe467ae395a165266ffd348a0788a92bade92bed03e8f9d5f3ee77489e2953336ed000e8021ed5695efd60
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3yGNkFdYfBCJisE+aeTH+WK/Lf1/hmnVSV:SOoT3y/FYBCJiim

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
4776	msedge.exe
4776	msedge.exe
1840	identity_helper.exe
1840	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3128	4776	msedge.exe	82
PID 4776 wrote to memory of 3128	4776	msedge.exe	82
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 3252	4776	msedge.exe	83
PID 4776 wrote to memory of 1704	4776	msedge.exe	84
PID 4776 wrote to memory of 1704	4776	msedge.exe	84
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85
PID 4776 wrote to memory of 3224	4776	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\34c6410d175f417559a07331b573eaca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc284846f8,0x7ffc28484708,0x7ffc28484718
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15192328040890122913,8140676533112699228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
01df6e8fe77cb13be1a7c857ec548fdb

SHA1
321a97a50e51037fb9431bcfd1a15ef354455c5b

SHA256
4c34e1994665b55694726f6c188dd2124cd498e0c0984574ccdad9f94cede532

SHA512
5c5dc1da5645677b33d31b52bb8e212bc2cc16d62cd2d8a16adb74eea2231d92683eb6755626033040be3b7d4e92b659661f15239bced25739d63abaf4e29038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
aae8b321205073b4e9f83e0048bcc815

SHA1
e642ef75f3fbdd2d33499b568379712e327c78e4

SHA256
9d14186abe61b8f3001eada9a8a8c2909effdd3386af4feacffd8750047e0d26

SHA512
93905f46ac848b83fa16e2132a14e80123be802f0d538d213aee108d8ec8d612eba0e13a89d0bf33131ed67cd8657a574a299d53e1fa123b93507fc976543fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0e19a532cf70ef8739edef5969e60d9a

SHA1
eaab77a65f0bde97a85e84ca40f42221b15b9d24

SHA256
72672c6eca7e9d1e12e3848bbcb18f7d5d8e71acc906f21ee4248cdcffbcbaff

SHA512
7cc62b692c194eff1257f00ffbdcbd22023f158f5f5b07341e5aaca8621649189ce4d818564df4902e515c2bf16ef20ecc96baa0b8c7ee5dfbce2f94bf542148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2ba1d77bfba6b7e3281d4d1e425186d0

SHA1
329eb2beea8c2d3caab3f80c63dc61b3e69ea5e8

SHA256
6d4fd7c04bc63f442cc4b8d334ae280a04ba49806d474496358d4340c06aaeee

SHA512
d931a9c872ebb296fc5090fefbe53b8191217708326058e9ba59ce7cdf7c0005d4792d51027de9dc49bbfab41246646279f3f70a64a90360f48fea3a24c5384d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3803323fdfe3eeb2194eba9067455bb

SHA1
129bb0928278b0533222f6db70cffe9975e5870a

SHA256
9f1821a6c699fb3957decb930fe257f8e449f132cf93c97e3eda310d4c332f2e

SHA512
323ab46e3afe704c1c92d63f222458ca486d951aa0c39fc18145413e83127d5ec1dec13059d8ceff0bef6602e3cc929bddedd1f2ef1638890cb647ddb11c385c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
42b84d9859b46a02acd8974243b512c7

SHA1
87b6e4a225b5a808feeb7f85f574be8db58c80d9

SHA256
378e3d3f22bae085a5576e5162d9a92e6cf22ae1a92a4118328cc61f608763e4

SHA512
8f9dd0547db2836b020fdb11043fbb7167fb1bd111d67b88db503b3857f821529d28066a8d67f1a4b5c21a8f9a92de8982103c9f47abf4a89e2dbb8f04c0b043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
440ec38ea9afbd829f45b968329d5267

SHA1
11291d4527c0acb777a0e14b4b5bab9ea49d1206

SHA256
a46b473e9c54559f6490e182b834008c6071feb5227dfe89d20e17509b55ab6b

SHA512
ebc30f94a17e0e22d826801e98497dc09822db8b85c5ec15ba0bd9ab0495c6c4e955b7699d800542782d9d80f654a0b6688bc79c009f25b4184012e15850b606

Download Submit