e465180ff5d1670111b559ee69e6d654d08d5e48497576d808dba27e98bb976d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 04:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7461f16d4df7ba5b49bdc1f4ef1ac11e_JaffaCakes118.html
Size

82KB
MD5

7461f16d4df7ba5b49bdc1f4ef1ac11e
SHA1

6bc070717777da7318dd940c51134bfa534d5821
SHA256

e465180ff5d1670111b559ee69e6d654d08d5e48497576d808dba27e98bb976d
SHA512

d878845e9779347c4b3b07b4988884db2457ceb073de94a9e12ba339c70e7bbe9d5552657c5632a0849a8ddd60ff5ee2498be82dede2f3abe216169274fd90b2
SSDEEP

768:FlkSgOriWNQuavoBgGXh9KlKtCMOTZnUqdG7BMDBZ5czUWjkuA3WDDv4+yYGPG8/:4aBh9cKMMOTZUqM1fHQIvb8vvYXw/qU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
2512	msedge.exe
2512	msedge.exe
3528	identity_helper.exe
3528	identity_helper.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3344	2512	msedge.exe	83
PID 2512 wrote to memory of 3344	2512	msedge.exe	83
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3436	2512	msedge.exe	84
PID 2512 wrote to memory of 3024	2512	msedge.exe	85
PID 2512 wrote to memory of 3024	2512	msedge.exe	85
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86
PID 2512 wrote to memory of 4760	2512	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7461f16d4df7ba5b49bdc1f4ef1ac11e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2a3446f8,0x7ffb2a344708,0x7ffb2a344718
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,11888616190707351296,11580621653044423454,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
898e75cac38cb264dfa66cfd504584da

SHA1
dfffe5d3e0cf314c82e5eb244f76408e45e853ad

SHA256
b1147fd76945a4097b9c0a8529cdd3ac72a35689ab490ef071aa136cbfda4699

SHA512
e2d6afd082cb1aafce41696b934d332b2aeee7cf5cfccf76d4060630c5866609bb59a4efbfdb3ab680ee6022c66b19636ae2c4536846abe9328836dfbd4a00a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
33b05aca5ede893075826be88d45a18b

SHA1
9f3b2be5f66dd9210960e6a2ab7a8f9f2cff4685

SHA256
1e86aa957c3c65b28f3ec59e4d604a9c49687c9a549b82da18a74329eff604fd

SHA512
b51e2021aaaaae305d41328e1d6e94f4960aa7d9b47d7107aef74eb41401bcfd81e3bb0b1c388d142dcee66790c74bd54607666bc379263c819fd41d8519746a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
47c3dc88ef6c76a235b16d146bfe24f4

SHA1
0ff3f3011e5d2c14b48531fd74ab60e9e9342d9c

SHA256
d16e6988a8d0497c5449f8ab4674cb95ed3604d1faf879020ef4eee87de205e3

SHA512
3ad0ecc6aad26eeae9804b1f9cef8adef423e66f6b9666a2f37597432c3a594c89b00245821c091c878b7c483924d79348424c89c9e251dbf20a160119685eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a4b9bfba8a872c5ecf5a88c93120302b

SHA1
571f6e2cbed32021108983f093b57736811a664b

SHA256
9c86173d16f30e3e74d328d749291c15569930422839bc29fe2894b70a281898

SHA512
307698f1e74be4e211e896566317902637242108f336f3a8363a2aacfd33a80718c4ca278e10cddf4674a0f5c49ae3d90fb4cf336c6312139a1f249b20007d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a2d86a553ffb7830baf503816d9a9bf

SHA1
a008d7409a231a14614b1ddf36433cccef6f264f

SHA256
e33d28ea2dfd5d98ba5130d74dbf3c75047a809de80e07d812c4264418ec4f2d

SHA512
6c16fe578707d5d06f948f9b44e48bcab543c9385c26632c1d87ed39b83b01e969bc3ecd7ee1b00d9476d0f28996fd44b78f57add510fa0f92acad654e13dde0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ecd872166b1ae2a527f8a354ce72bc24

SHA1
8f0148e54fcb800f5cc98b03b499984fe8861fb2

SHA256
4d436d1b1a210bdca109fd2e0eb599d801c064c396411dc3191304a77a16a008

SHA512
acc600f1bf0fe07a92827233f6f926a1d66d89fb6627e6d38082400dc241cdb18d1b7c873dd4dea484c3fabcdf0da9a8158d203f862b0c89d9e307b56a4d8e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2904fa1a8158e623816d7d05592aae03

SHA1
77ad5e76a75401a598f1fe188243bfd28745fbec

SHA256
66fa544aa40dae624c09cf0a3c481c53657e6758f88c8b17d94a739425a54842

SHA512
210d7bcba14e1afc46a352c3e8a8dfb289bfac004992d51c8eee4460272b27c4d5162c31ae3c1df29a68f8892df7c5fb6d6432f68103b354908b208595de6e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
caf07ec637ce823f56404584bb244ea9

SHA1
abef8368e2022653664e126dbc4fb1152f57491b

SHA256
978dbb2eeb19b66e8c81a3e5428b145d7219bf10fa0a699dcfddda0018a213b4

SHA512
fa74dc17808739d04f3070c2d21c6d29993e570c405a9016a08ec3a4f335abd313fa16a63d912adc204bfa777d60138f14875c68b5316e72e708ff3bc6990d1d

Download Submit