a4db7f3cea7fbc11f11b8f33f02cde3d019f2b8b221c6d7d2b88978f7a3ffa1b

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5039f6d7dada34172517cefde8b7ecc3_JaffaCakes118.html
Size

175KB
MD5

5039f6d7dada34172517cefde8b7ecc3
SHA1

7f4e94042468be0e5c98c49e4f6ac80ca127a6f4
SHA256

a4db7f3cea7fbc11f11b8f33f02cde3d019f2b8b221c6d7d2b88978f7a3ffa1b
SHA512

f433f46d7a133c9ab8792892480e8601478a7567c76442a0e8352eeb4ea6c44a0ecd2fd565c8943fcc679121d81e3d9bdc271d4a0b0902386d1517c14d99e9db
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3xGNkFRYfBCJish+aeTH+WK/Lf1/hmnVSV:SOoT3x/FkBCJiFm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
2632	msedge.exe
2632	msedge.exe
5080	identity_helper.exe
5080	identity_helper.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4052	2632	msedge.exe	83
PID 2632 wrote to memory of 4052	2632	msedge.exe	83
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3336	2632	msedge.exe	84
PID 2632 wrote to memory of 3580	2632	msedge.exe	85
PID 2632 wrote to memory of 3580	2632	msedge.exe	85
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86
PID 2632 wrote to memory of 2340	2632	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5039f6d7dada34172517cefde8b7ecc3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff968ca46f8,0x7ff968ca4708,0x7ff968ca4718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8212892210953187805,10627808618132860970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
46KB

MD5
f0d81b309d4441d6dc22bdcb9e9e7d01

SHA1
77e7510fd01735991f8eb242a8a20acf5c7326d6

SHA256
90b890766ed0dfc173b119f625e4bde7785d509a76d27354148bf0a80a09889c

SHA512
79d3758017eb11ff478e0c258405aeb66eeef77b6041689708667948c85c1ff27688491eb8fd7efba3e5d392e299c055b3ae54fd212a0f5caaca3d91c425829e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
def2296f9bc41e8e22e0e0cc311805b5

SHA1
b04b7c03fe4ce2bf404f47382545e0c633f924ee

SHA256
a91d00980f64841a77cde2c1c7614f7f5d738ad0704fe0814b22b404638961d3

SHA512
134ce08f277152d2ef7e16ad5e8a740cccffeb4cbdea009be56f3948aaee302d88ac8f061e2eda8ffb630f60d640b2341cb344e7e66970c88014cca66c0404c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
af3cb1c4389fb3301cb81f732f86815e

SHA1
a1ebd2856f0ee36a5fa9255b0eb6e29a3bb6985f

SHA256
df490bc31f1738eb8b8cb8650578d11afe9381393a5a024948bceaee3b738bac

SHA512
d2eda2ef6fa2bc610c05ed9ad24b1337c2738e3d42d4c3755fea064d3aace325e4479b2616659002d2430e42d70477e995d20c58f52a95500126ad6c55cb1108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
933b01fb27595ffb250244c15789be05

SHA1
84e3ff017dc83106dded8484abdf9c851814a231

SHA256
ee842ec9f6787cca2ad038003a26f9a236c65911d5fb043d1a4a8b3a502ca555

SHA512
5b46974956c27ee131bdb17695e705064b3b44fac324a496d9601824901fabd5507b23ef2a2040103c228925e8136947312e35a56da94c2ad1a53b0cf9fa98ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a91b08760a758862dd6f78e96776038

SHA1
eea37f3a95e17b4c89ffb7377103514c4acabff9

SHA256
840be1187cef2b5f258bfd172051ecdc2dbb5da7b44a60692b72028c17cac735

SHA512
b6f10f1fcf311f42df7c7d94ebd2f2f843e1ec43c3ead7028e7f547998e78cb04fda4f21db13d79da90c74f8f35ee6b59b29b6bca40c9f8db18d021583f50c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
757dcbac4bbf9e4d79c014d1dcfc5822

SHA1
1693a034beae3a1258974fde594db344c42bffaa

SHA256
b6bfb5699cc1ec081876ace6f04c20f8093440ffd021da2e2c9cf622c7f152ab

SHA512
523ac6379c90012147a0825e5e47fc66fb44db9e28fa2a69ebe68d29b3648e1c3d612b39126da572d38fb03648683b90058b0667fb5e7145d28fcdf9d455effa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa63d4ca3c0f2fcba666abde48fc2638

SHA1
41b5b46ac9692aa246a70cdc79e65f7fcfcb4e04

SHA256
854466839903349861e2e95db97f6999fbc4d149e903c3c3e4c2104cbbcf2c68

SHA512
4dd8a1b6b781837f03d578b8f838a790b12174054f4eef2d6d46d0f4dd17df086e5835892b55e0065e069b00af65c3fc6742f73b333ae47e8894a40b20facca2

Download Submit