0e2c037407e3ada1e1248cc19c803ee437e3ed31739d1191b1eb8e76a5f0c098

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

424b11128d4dba8534761d34dbad6c11_JaffaCakes118.html
Size

190KB
MD5

424b11128d4dba8534761d34dbad6c11
SHA1

747533dafa150ef8e18febb0ccd365a50472f121
SHA256

0e2c037407e3ada1e1248cc19c803ee437e3ed31739d1191b1eb8e76a5f0c098
SHA512

069865c317377f99daad1d45e10a85a73865569a74771e678c3afc1b688db5c4f805177775f2b8de78735863d6e6fa5cbf619d56fe199b9b7ca0d556456d73f0
SSDEEP

1536:8xwmejacfHsr4OlD5NYh8Jx4x9XG+F4lMCP8KHP9v0xZFhGUYbNzXA6p41N8Y6lX:3VOltNY2IjXGJlMK8KHCrk3mtt8Ic

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	sites.google.com
21	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
3884	msedge.exe
3884	msedge.exe
4000	identity_helper.exe
4000	identity_helper.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2440	3884	msedge.exe	81
PID 3884 wrote to memory of 2440	3884	msedge.exe	81
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 3596	3884	msedge.exe	82
PID 3884 wrote to memory of 4664	3884	msedge.exe	83
PID 3884 wrote to memory of 4664	3884	msedge.exe	83
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84
PID 3884 wrote to memory of 2552	3884	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\424b11128d4dba8534761d34dbad6c11_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9924846f8,0x7ff992484708,0x7ff992484718
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1344 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,14670408447628715641,4699086509522479844,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6ccff3caaf6fd251c89ee21e172761f0

SHA1
f8f1aea5f223b75c5987b9620e37615af03eced8

SHA256
053c5481f17615fcedf21de9e5cd7dae2039cc8973d094fad16bb19d41245db0

SHA512
08cd15eb1e61f0d3ab75c2b89d61334f658169bc97d15feb6c233201fd1061ebdef820c18d383f994b5335ce1f5fda717701767850b6898957c6f0827dec88af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b62c0f4046b4401d82c8e8cd6b9ca1c6

SHA1
0a361928a665f2f506103999d7abce3735ab413f

SHA256
8001916db87acd12e7988768be26d7772c8be3c84b86f00d50642e962869c4df

SHA512
80ded36207050bebe5a4ed3d9e2d8cb1a381f2c551cfee8188756b026375b23878caa15bf2e41434f153624926b5cd40a0c36e311973733bb02a70deefc127f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3b382d8d04a216e80c5091740567a180

SHA1
f262a30032fa114232d21be90c0139eaa038ca7b

SHA256
1ed56e89cdc9385e00ab870fba854c23f18fcf1edda261a79e57eaa763df961b

SHA512
5d79cb5d32f8253cef575948f90ea362bf6d037443324ca7dcd073977f74a7f689cab66a3aecb93479956da26af86f6f6bd2d289c09327c657e4d281735ef61b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11e44560935d9ee5e0faf4a3e9e0e997

SHA1
3464d0159e35f974af59d320126a6f75a929cbc0

SHA256
c7e933da11e0f0d623c97191f21d7efcf5d693a70abb9b95b3ab72c4f87f30b3

SHA512
6516ded41c37fc703f88b4c65fd4580f35c0e1811ebf125bf5dedce6a7fb13d88c2622d9dadf17004396f8a503c9f769e45538349b9d811643bdfe0a0fc143e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c82c68b153b3ec4bcddc66d6f23a2007

SHA1
4d7a9ab6a83497f7abc698e43ec96060fd940440

SHA256
da61b4d6e7e44a40c5db858e8e03408c602f6facc987af168f0a333802f61b31

SHA512
c711e9d4b378d3b1536d2a2238538af797e50c5d2cfbb224e9ec536837279b0fb4c51dd17763d7d5566c63085c4613d5d34aa8ddb5608ea01b1cd2d41b122794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
723361f6877e1998e25db71415119028

SHA1
3aeb85af767992cc30a3514fb0339559164ea450

SHA256
f505eea8e2fbe96a8d776fbc2629e414fb26094ea041ac4e6e7d5386b4917d08

SHA512
3ab96821b7f17a8084dc9c5955a2515ab988e98ba42b24a5571d7c560e12fc66816e4f58ebd9e5b50b4878b366802ed9476ebc58573e2dd9cb6ed1739eba888c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1ccd048ac6dacb13254a43d6d9ac9772

SHA1
375875f6702866fbabf4c60df1e95a99b14d4ed8

SHA256
c8fd52cd870c7b5cc6e76cc442e0c2a4af348accc4fe3029eb07b3928aae47dd

SHA512
427298d6970170bf14afedf7396d1ed4d5a8f0bc1a3743c758af33d2a4ff5cff7bc02d2f2a75aa2b8050b131380fe28da33ea19d986c014554e8dee1f977f855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19c10bf77b154563fc80edef526c49ba

SHA1
19136a5fa350f5ce455044e7615f8186d53720e1

SHA256
e4a9c09075efe5feb64dfdf8d505c9d98b6a01495a534897e7452df0a2c3519e

SHA512
6d2c23b8f8bd8155c34e5fc9df20acfb100d89d58618b6c612f0a4f9110482c636af039671898d5bbf3047b9b2bf9dc67022661c16473c21586a797668df2104

Download Submit