65e2fcca1947af15f739f01d53e566838ba9a3b2c7881fe21966003ca5587ca0

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a2427895b61592a3e7db29b08ee2955_JaffaCakes118.html
Size

38KB
MD5

7a2427895b61592a3e7db29b08ee2955
SHA1

7727406e2e865802596141d446c12e61ead2538b
SHA256

65e2fcca1947af15f739f01d53e566838ba9a3b2c7881fe21966003ca5587ca0
SHA512

0cf834cd93e4e765891dd627c7ad562a16de6405884aca1efc2109eb12ef20e326dc6eac00a4f43a765f23b0fbdc75734c02d1b869c89d0c731ea2a839441c2b
SSDEEP

768:hgal4Hse0SKlpfcvfbkwtfWE9toVvUyXPyrwvXJN8FOltzPp16oWeNoQgoGZjqUy:hXWHse0SsfcvfbkwtfWE9toVvUyXPyrU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3964	msedge.exe
3964	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 3820	3964	msedge.exe	82
PID 3964 wrote to memory of 3820	3964	msedge.exe	82
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 624	3964	msedge.exe	83
PID 3964 wrote to memory of 3868	3964	msedge.exe	84
PID 3964 wrote to memory of 3868	3964	msedge.exe	84
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85
PID 3964 wrote to memory of 4860	3964	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a2427895b61592a3e7db29b08ee2955_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,922635350200239817,4149989975967754297,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f959b4a1a74d954334272f60204e7525

SHA1
e320b3653666744095ba75a769301e6f3ef5ae63

SHA256
3afbb82b1f941561a2c92838e34a3ff01005b23a0274fb08132e6fd168ccfcfd

SHA512
c3bfe0a44df657dbf4916ad9621398004068041715e2cd5d2e30dedff1a6546a69a07261fac4e82ac68999eaf81c0ed092e47ee8f195437d3cf0fb60e71eb2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
588f31cb8344f21aeeea30bbd18494c8

SHA1
4c93e0f9dcbe4ed1b64d6b3f5ba8179810adf9e7

SHA256
e895efdfc9e41c3710a81aac43de40e25b1b99f14cf82e95ea311439a6ad3a6c

SHA512
37c4b6162b3105f41fd8d6df2c2260f62da6b010ae6da8b739e8260a2d4e083a5fd2d31d6f19a1653504fd661766d65446e0dae80a330b15917e3f850cba5524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
254c0fb678019174bdd8c673b9ccc6fb

SHA1
1b8c2e1290679d15715fb2149449d86946d15d2d

SHA256
4fca301b7370bf2121b110e1e828dfbfa8a038ad70c1df2102e586bdc2ecce5c

SHA512
e134bd5b1a77b46513c2637ad8a27245ffd32fb81af9612874e713660a8b3d112d4eb6efe82a858c566cf2030eec565d69219702af59090aafe6af2ff6f7dab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f18e42a5f931a68c6214d1e76984a895

SHA1
1865daaa80c4fefa7ae3018750407f1cd6fc4f43

SHA256
6be89bc07722fd3f6b3905766dec8d1fe9ceac80798f2a550de2f026cc90abf8

SHA512
b78ebf6a858a5688738f4e189e8fe59443285c2d42fc3693ad409329cf11b99f7f883ec7e94d068e46bf9870fe4c8d955c632b6b28ad0ee1e65204a0363b9f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
168d5e28601efde55467796b8bfd7293

SHA1
fdefa74091c0e59e0565f667e555016cb3c057ae

SHA256
f76a6889ece80f252ccbc53c856cc38356a5c6c362322e90e3f04e52b21bd77e

SHA512
3253ef04963d0197cc1bd0a1b385d00fbe02ffa51fdf0fae5d656982e28c99a01658e4663ebe9f8f3884a54a9f053d0b046ef23f83d674aa7b47940c1763defc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ee7e91194729c441dd8025567e9b7e4f

SHA1
2c02f89280234603feb847a77759e852bff58ce4

SHA256
0538fbb1bdec204b28b223289240d68b2b42d2e336a963cbd419a3af9011bd90

SHA512
00cd76f81eb1c96cb5654c4f296ec42f4d7c2154886298b52788269d8e9cdcda7036a2d90fc151b6a88b6b726352fb657d0fd04f4280b1f8e978c769877640db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3047463f2934b65f4c979f7b766d810f

SHA1
8c23a5906589b3263902265c2ff8e2ef8c05e483

SHA256
3cb2ca3aba5ad5b2d6d845eb65ad6d3bd70e0b02a0a18c4819f247b2384fb700

SHA512
6a9a4f5d565f279d2db1682d7b293fb73d9e80fb4ed1f90c35d2a47b8f0f7184a5d22b19a9ad3a7dc86593b7dd37852b9f120e79278169ed79876c280b0fc435

Download Submit