28e968bdea827dcf07a575bc5392e427fdffda3bb579b09bfa6136c3ecb4ff74

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37df13821aa1d1025b4ccef711106b8d_JaffaCakes118.html
Size

175KB
MD5

37df13821aa1d1025b4ccef711106b8d
SHA1

a61a6b0efb381f0a51042fbf10576a71f1463fd4
SHA256

28e968bdea827dcf07a575bc5392e427fdffda3bb579b09bfa6136c3ecb4ff74
SHA512

9b0de98201905ef4acc9736d689e4b9e46db919f76de0ecbb3e7c95e21a017ccd45b81bdd37a5c0336b8d740bf13c6251c93ae2ea37df73c992728b9576ab82d
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3XGNkFk2YfBCJisg+aeTH+WK/Lf1/hmnV+:SOoT3X/F0BCJimm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
3552	msedge.exe
3552	msedge.exe
3624	identity_helper.exe
3624	identity_helper.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2028	3552	msedge.exe	82
PID 3552 wrote to memory of 2028	3552	msedge.exe	82
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1940	3552	msedge.exe	83
PID 3552 wrote to memory of 1952	3552	msedge.exe	84
PID 3552 wrote to memory of 1952	3552	msedge.exe	84
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85
PID 3552 wrote to memory of 760	3552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37df13821aa1d1025b4ccef711106b8d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1e8a46f8,0x7fff1e8a4708,0x7fff1e8a4718
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,12122050794357707817,5016498632128879117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
46KB

MD5
ac83857f0497a4a0e7669329827cf228

SHA1
18ea483c966969e43a654fcadea9719a8aca370c

SHA256
43337a1354f376890cdb73f3dbaf95a8027761c574c30cdecb321096be485d3e

SHA512
6a35c50764d31d4bac07ddbec2329238cd04f2c58c00629e523ae7fc2a7d6be5d1226f8fb6c3c1043b215c38c47951a66fa8a9d4f4d6ddce7664bd1d011db2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
c0b992985d88c2080412767d93a4b4f8

SHA1
bba84562add1c30a035de5e59bb514bef7d55d2e

SHA256
01aa006baed4d8f38afd6ea377d1861d2f4ba9b66859e8d2b3dfcef47dbd5ba3

SHA512
28f74e10da36e8f8502b0301ed728de57825701d289c923b9219580ce84d039e65a639575fd3a2f14b40921c8f5e606419cbaf5a45b8b69ef9431f01e7e7ada5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ce7d6ebd2695301f27457ce502d55514

SHA1
e3dcd2a12a645b78d54ed6fa28ebc092c05a2725

SHA256
1cf5e2318018e7571f2d0f2f0b73f31829332460994983dd07ff5fa8ec7be9e7

SHA512
dba78962aa7c2227ff5c7b5d07b00be06e290b290384d00192877ef2cef28e6a4ab20ba68758d4d65c49c70dc86195ee7f093e58cc57b7a4f5708727182a7994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
855031f68d835a10e1c5337aab7569f0

SHA1
8f8c47a8a8ec9098fd0dec36b751aec05336940a

SHA256
13b461e2772c7842da4fe13fe9dcf812579853784f67ee1a84e56d500a8904e1

SHA512
14e98ec5935934fe4b0599b8c67ee09ef1bbd7faa9cec78e184260777dc9cc34f137031cf60b9b83c7c024dad3575acb4f5d6041b08801a73fe0c4b632576255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
59a1477295cea97f427965621aa7f968

SHA1
47f823284cfe4a956e2fe9c378813eddbc34e722

SHA256
30083ea8bb584e83018869635fa16875a118a33438f6d94eecb40d61ee12cdf0

SHA512
2f24c6df53df1d590aae7b5b37aea59f58d53ebc61ce18014d9c0a58d2d5b972e31105080747c6db2568c4e613b5ebe232460f0d1035481262042e5ad1fdb74b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5680a6d9af5c142f58f0ae791dcbeea6

SHA1
0c3093665dc1f72110754bb1b4c24abe867c0b49

SHA256
b535660c56f606332e07f6c119e3ac0ce08f10b86cafde817e3456f6964b16b9

SHA512
1e634366369cd26f2ebee3b9b15d52868a6542fca524af14c243c56df52e3d71d28d335ea5e322f2a7065e6237a1195ee7433853558193ca997bb830631368f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1df7af0e9d98109c011e605edb883de

SHA1
7f4686fc2ea4d00ddf9373e5d9cee843fe6cbe46

SHA256
2b81d1e0b0f914486e8a3cbbf16992becb892baac972f7f76bfd250a369298b9

SHA512
678a7fad1290a43a664ebaa852626cd80f3946746a28359474f8b9c14537e179a82e0383e913d8f002902fc447b4ded61fea5c2b24afb2a2b856e8a8187cea8b

Download Submit