405d7ec450bab097067977b819250056f874c19b7f4bc85ea673bbebc5b176cf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63f6c7ec27bdc2f0996b67e3d3704218_JaffaCakes118.html
Size

175KB
MD5

63f6c7ec27bdc2f0996b67e3d3704218
SHA1

fb3aa389b3726bfceafaf051e3ab546deb84a328
SHA256

405d7ec450bab097067977b819250056f874c19b7f4bc85ea673bbebc5b176cf
SHA512

c51aa7c0d7efa2aad29fe35fb04f8fe5cc87d7c460a00059585e1068f276e825aad8b17693df18b11e481f47ac43b1550c0003b689a90ea9a361cd0a7a110114
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3AGNkF2YfBCJiZ7+aeTH+WK/Lf1/hpnVSV:S9CT3A/F/BCJiaB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
696	msedge.exe
696	msedge.exe
3692	msedge.exe
3692	msedge.exe
1924	identity_helper.exe
1924	identity_helper.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3692 wrote to memory of 3068	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 3068	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 4988	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 696	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 696	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe
PID 3692 wrote to memory of 8	3692	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63f6c7ec27bdc2f0996b67e3d3704218_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc53246f8,0x7ffcc5324708,0x7ffcc5324718
2⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
2⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
2⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
2⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
2⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
2⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
2⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
2⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
2⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
2⤵
PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5435635822001629780,2693561127085069449,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3728 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
5e675244379a8049248e036b44d361a5

SHA1
7762f6f6e8442f9c1e127282f8acfec2c25747e5

SHA256
427128dbd6dd7c0fdb8ca89b2fc223deb8252cdf4e30895e203fef6fced29061

SHA512
0990f6e794c4adf62a7531c0ede5f7a6e29e03aca136cc3ac8f19f374a1228c45d7518de74102fdb98eb40a9de2d42f9255c4338b440f661ddb7b6603c465c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
216070af5af0ce156227ac2e2b8c6186

SHA1
5739cea549e6be710ceee84702cec1e403074c96

SHA256
628da93f600b88cb96de9da6c67f3523f4058a1490224487ecab1638c5d15d95

SHA512
e42e9d55671ef30708d9e0597ef5eb76b1306483576f27c66a7ad98464e279f6a487953350cacb23c4cb31d19ba380a3b198a52a296308fd6ee8dd17dd25dc85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3b322cd0ba8fb92460ea1affb4edfb6a

SHA1
4df29208eef47ef6f9a217c04bdee2cd61fdca12

SHA256
c8623f2c3a768f9887c093291f0ce80442aaf00ee1cc6e2a2117e7a004a5208f

SHA512
6e1a286e2570fd76fda39c4cb543601d20fc0c83bdfaf1bd18dd77d8b844b5b95bf03f084acc8f0a426fdea332cf9eb89007947405a8767ab402f25bf8ddf510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
52090550165a689bd0a8ee69fd97f6f0

SHA1
f38d2d9a60ef0f6c5720f2980495e6f256103a81

SHA256
ec7587fd1fa527de0ff7bde0752581aa3ae94cb2b0386affe915c0cd93640744

SHA512
7f3d0c130f0ec4752ae641380e0c9e1f77d763494adcb6b17d78f4a6cb2e97b27e412929b7e1e17d12e7bbda08310632cae249e458055de986cbb812b776b51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9dceccfda44444c8ebb3926114510d9

SHA1
784c0f41ace2dbaabc300aac0978dc4c0df0f965

SHA256
b390c84979f6566fb5c9dadcf55de1bdc7115259cbb26f6e68744037709644fe

SHA512
71ba5c19118ce101c5332cd9baf6a9335d594ab09810f09ed98f616c38cd8ab38a02727a751cc3a2514b9332ea4efded63e38c8a261fc39a10cd188b776b4111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
57b073a38b3d6b05bff3844c3149550a

SHA1
4326573dc95046920c8da346171714271a17e2b2

SHA256
01e2b891aa08af17467f42e2813c3fa2b3c0beeb99a73ae09923d9f4cef24d8d

SHA512
dbf81e204284a37128ad231afaacfb7959f34590303437a5bc256cfefaac7a43b82295573800cb47a7f1d63111c1ffbdb503cc5139992c0eb5fe55b470973c79

Download Submit