8e36cce418defd2dd8e272f21eeed1eb1fe187a404dc46c713ba2065b70eb820

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e56ee1a396de83e148ba9750c78b635_JaffaCakes118.html
Size

55KB
MD5

5e56ee1a396de83e148ba9750c78b635
SHA1

edf8c9cb3e7222c619784c3426f38e4555ad3292
SHA256

8e36cce418defd2dd8e272f21eeed1eb1fe187a404dc46c713ba2065b70eb820
SHA512

376dc6f0103627b3a4c515612e15e67d23d2b785c801a8998cfc566b64ed89afa0770424ef62decc0a6364d6922c65f00bef7c591c8068753f051d7f4f94f46e
SSDEEP

768:TR3xi+pHvvCIojQoxrzlc5Y95c6CXXo/HlUXfr/T:2mHv7ojJrzlQYDlHl4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
5040	msedge.exe
5040	msedge.exe
2824	identity_helper.exe
2824	identity_helper.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 776	5040	msedge.exe	85
PID 5040 wrote to memory of 776	5040	msedge.exe	85
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 1956	5040	msedge.exe	86
PID 5040 wrote to memory of 4936	5040	msedge.exe	87
PID 5040 wrote to memory of 4936	5040	msedge.exe	87
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88
PID 5040 wrote to memory of 2288	5040	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5e56ee1a396de83e148ba9750c78b635_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,11708499857170407751,9410376415553995798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
39a25964413251e4d7003690572e127d

SHA1
43294c87b6c204422cff53f5b597782d9621407b

SHA256
0f869da73757c0baad390c2cd24a8caac1d5a65340cdf1c8879b97531b2a85e5

SHA512
f9280358889b401a4aed99150c2bd5a52f2f83b4b9e9ab37401b0ac1dbf443740d6dcce693779c87e87c611037102754a1d9ff70a2e306558a5857184f354d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d3e43c6a083f7f85428a0d912d0b2516

SHA1
e9ffd7d2e2b867f35fa0b45a7edea33307229225

SHA256
da6e39e9c717f02062a9e157a4ef5eaafbaf39d513c7091fbce29bd987c78b5a

SHA512
d32eef628be77c7d8ce05a8c6d1f46e1e51dbc8772517ee442f72d683a0b569cc482c9adcbec2272d3644282a74cc9a560ec3a19cd94151c565b794b43c5789e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4c14626e13817644c9a1ebc960b3e612

SHA1
c4dd053abccc8155c00e2be43a1cf56ddc187a85

SHA256
4830a3d57c52ab7000791a6f0200ea57075f7e9539c6f57f5a857725ff5f8987

SHA512
c13bc91393ecee8fc88acc051b0b9d8b547bb703da33344a99d31596ef5fde293c0a46624a0ad50ab8fd9a5f0cd667db0a7c70cde4c94c22d767d13aafa2cfe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1e301c10539da274d54ed05653e9fb0d

SHA1
66cc5dae5ae0c8637e75e3121980e0f498df1e58

SHA256
0dd4e09f8628e6719d06e6b36baf0705e4a4fb571b73d6d4337c274ce1bb9ce3

SHA512
6a14fb2644270d4cdf559a807f42eed3175e3c7a23f406cd8752cff26e912414835847de2a71b5773c5c26b7a8928cd31302e598c4330ae6a5667e66ee7c5d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d11e139d3f524f57fd63aa2c4738443

SHA1
deec76ac707c611356ceca3e16ed7898e8249606

SHA256
c129a8ea64d059c76b1134acdecd531dbcc0eaa4da70d450de973bdd864679ab

SHA512
b103b03b5c0b2e8d3ae97733c70040a95f1b6e707b6fe4e1bc0a56200433f7ef00fdcd10b187a1084e91e9650dae5de72477dee78bade00c865dc77f2f7a6ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b208ea5fd92c5188e52188d784ac039

SHA1
2517c13ae689f44b00caa82802b38a0186c03485

SHA256
b178490efe8d44e51dfa4cb301267beabce89ddcf565814762640d7bc5ae45de

SHA512
dd32e94b5312155c4cdd036e17656d95aa63f4fcac6b09d7a1920c041c3ad63f8e3110c373473f10c17c0235ab23e0c002a0c8d51b1a57a193c355ff7fb15678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c6b0d2c4f52fbad7c4703604a52b8555

SHA1
cb08a0bbef626a4e7359367b0fd5415ce838379a

SHA256
7ee44c7af7397a402bd333299d1a6c7edb31600e8fe82b9381b3bd89c77eac46

SHA512
e5b9d8d6b59358b0a73f76e782cc451873d4bc444b0719b6c77267ae329e26c20d269c3f5da3552c5abef2dc33874af9362670d35b16eb2b5a15db7b66ee9c22

Download Submit