d0fb6284d9811ed618b7965254b3429bcf5189dacc3ed9b87f302ff438485868

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7513fda30d0fc2935c7e193eb56b4b9b_JaffaCakes118.html
Size

175KB
MD5

7513fda30d0fc2935c7e193eb56b4b9b
SHA1

b665311bf1a25f0cfe98204718d9afd26dfe0752
SHA256

d0fb6284d9811ed618b7965254b3429bcf5189dacc3ed9b87f302ff438485868
SHA512

b5458a57adf8dae7125f7207718c73081fa7ef476a6c75b94d6958b2517b9b6aeac2d026d356314fe449b95157856537113941e87c603cb480d4b3e95d128bad
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3eGNkFXYfBCJiZf+aeTH+WK/Lf1/hpnVSV:SHCT3e/FmBCJiyB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4552	msedge.exe
4552	msedge.exe
1624	identity_helper.exe
1624	identity_helper.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4268	4552	msedge.exe	82
PID 4552 wrote to memory of 4268	4552	msedge.exe	82
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 652	4552	msedge.exe	83
PID 4552 wrote to memory of 4416	4552	msedge.exe	84
PID 4552 wrote to memory of 4416	4552	msedge.exe	84
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85
PID 4552 wrote to memory of 4508	4552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7513fda30d0fc2935c7e193eb56b4b9b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe44718
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2617159665082389713,11750904270068368144,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
46KB

MD5
b4e4c40ba1b021933f86142b1010c253

SHA1
8901690b1040e46b360f7b39ecb9f9e342bd20af

SHA256
a1ad4fde10e0f378aeeb97ec0aaa27bbdba9ed434a0334052f0230e09fd891ae

SHA512
452cbfc40d99d69d65271ab7a6fb62c87d123813fe20898d13b938c13d54efb2e33eb04e165f18e9e91b6a0d02b3282b8e3bf2b8c65efaa974022d14c07bcfd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
c7c8d0577bd85a3a67c47ece58efbb24

SHA1
3cf1b60e8f4c03c5932cf443585092e87436e44c

SHA256
ad6da4f6d53a8bce36c8c448ae084afc20e2596b08653617f1fed2c3b03bc8dc

SHA512
1a7cbdeb2e812113d05e121506421f3272aeb88d2d0d829ad221d7440212db3796eed174a173bee2cca7be5321aa9a2e8777cec91bc5c35ebd6c6d23ab1a6d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9fff3e375a6d22d44b8d1254cb0c46ed

SHA1
c6b8d698cdac7e50194b9bb8c478b92e664c3db6

SHA256
ac899bcb0ffce971f1fcf53005edee73b6999e80b12692f919e6d5e46887575f

SHA512
c57ddbeadee5b3692917abe4b9c36cf5412fdb222e68a3e1251f8d3e4dc4bf653ec5bc4e8da874006a1156b1e8c50d645c1416ba6f013f23d676bfe5f757d023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a791e10cc0db7ad9fd6e87d6fe23cf98

SHA1
8f15dc16ff5fbea743931dba8674b251daab3ca5

SHA256
85449ffb4b87e4620a102df895ca3d5f3a365e916390180b7cdff5e72eac9b62

SHA512
3f444d9b654113430c5d0fc92de4a20b7591c532c6818925b8a17232c9e99fb8751f9daff13f306571df88c4fba38d42f291222ff8eb8b31b38913555c240cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e38027231f8bb03aa2535a37ef63bf6

SHA1
a3fe1b4c7077c0e53a9be947e4ad444b87fdc2e3

SHA256
491603f967bc100448ef5f77d460bd5ebc2335b6ec28dad3f881b8d7292db384

SHA512
71c227a96c88326a06d10d363b89a8c8507f34ba368ffd7428eacef0b8fca1b411065b896c99f107c8e49b7fbf48604f6c8cdbb0decfa8835dc1b9feb55c703d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3f6247e12635500bddc299ee3dc5704a

SHA1
6cb365f09851cd87991c45c86aae6d1caa508af2

SHA256
222bcc4f43c39c79789c32a34b35f76888312f689662c1f0e48cb35a17246b69

SHA512
83f6b43f1be37d76f2461ea40bda659b507d35690ce35fb66bc5c0f988f2a0f766b75df2a323ce1c3a91aa869e501d1860a5c64c721f8bd66f1c35f6d57f2f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2f18fb5619576b4f97ab6ecd852ef57

SHA1
f037edec49fd559d36e5fe854919ab42809d7290

SHA256
ce2dfedbfbb886cef279b1e60939f032af8551e7a44d3e2d9f76e14b0ef6c365

SHA512
9d7d458e329adf946f6c0a31c9a9fb398e46572a618ebaf4274feac3801739b88cb7265fa0de1fb6dbda28b3051c963194b02b9c9391cd12019f89afa2af66ec

Download Submit