b3e5f5fef366da2649538380e6203605845a6ce1f6ec33aa628fd4c5565ec035

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e575f6c754b93eaa448d45139610f7a_JaffaCakes118.html
Size

2KB
MD5

7e575f6c754b93eaa448d45139610f7a
SHA1

6200f975db91bb97b103aa0525bb5c701e6e4391
SHA256

b3e5f5fef366da2649538380e6203605845a6ce1f6ec33aa628fd4c5565ec035
SHA512

370b274a631885d78714d90071c58097ebf7262138ab0386c75e1fea9513e2185485a9daee061dea7b5b15e3fd75bc4eb644482caaf646bbfeb825ceed5bb2ff

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
452	msedge.exe
452	msedge.exe
2128	identity_helper.exe
2128	identity_helper.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 3524	452	msedge.exe	82
PID 452 wrote to memory of 3524	452	msedge.exe	82
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 4232	452	msedge.exe	83
PID 452 wrote to memory of 3176	452	msedge.exe	84
PID 452 wrote to memory of 3176	452	msedge.exe	84
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85
PID 452 wrote to memory of 4804	452	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7e575f6c754b93eaa448d45139610f7a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13863043392885613738,762909144799697143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a351950c8f4164369bd76a1cd9dd82e9

SHA1
62c5a56348d95532db92481d345794c8c1eafa36

SHA256
ca19776974a4fbeb0c2db2c1532b591cdd4150c018673907319c7cb45695394d

SHA512
202107e0fb9428d11b81d4c6bcd3e4bab9dbc8ca7948408e8916ff9bdae96a67859657dde258b9eb4f52b3ff730cca4e323cf922451aaca702949c233fbca957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9bbc8a25ea702ef2b2c9c79107fe0ed2

SHA1
44994eb13fca1c324f8929943ef96400c925701f

SHA256
549ebf757dbc309266c33fe5a2cec122def18066a733ba4809efa8cadf631967

SHA512
36bdbbc005b76f83acfb4a88d0b8c34b349095514a2bb7f3b46992b078354b059a405cfce3463f84c94c93a51aee7d16928acea71755cbe228a339b2489b3e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a953be932db38453c767ae4ba9b3954

SHA1
33c05584f4d662d21b61b49124870d0d8ce90b30

SHA256
a3358e10fd2b5862015a349f738e76338ac0b16bc81f26f4505328dad9a611c7

SHA512
2e16c7b4ea1cd693e0e50b2896d860893d4b545aad34903647130714ce65f7cba48384c06029d15c3061fde166a02f05bed0ec8f218a76fa9c4376538bcf6144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb17a1518f8c533f7114a378373d2420

SHA1
bdf6441c54b4ed3c423d4856249fa44f1dcd7e07

SHA256
bb38f47c26ff7595eb2b22104cb97a6b012bf480c53dcda539d4b29f15c9521f

SHA512
aeb1e283f544af26647e47926344647959edfd77ca3c8a16430894f56e9df10ab2dd4b18b1171676eeb173d90969e59db8108616ba74accd4bcb155e947c5f50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8eb9c87ea43760d4b88bd0357c5c6b2a

SHA1
4b21f7e6e108b2fd6976770ccb51b37816dba783

SHA256
32ff0f85b1993ce0c32623dceeeb0c671741c5866c8e9d21002e87953cf5460d

SHA512
b6114233e710b8d7659c345986f792b201b64d0670ce05db4bd35d2f3b7ce57abe5675a6bff83ea8d1bd07543f3c7d9b13147f5a3d689f32054b9f06444218cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed676ee8a261ad2ea1b4f2a32c8d1cb1

SHA1
f35bd0f6ec03f92dbeea5311580113ce302041cf

SHA256
3411c13580d279c5e018a6d650d1658de624fc3b0e8347fa00422963db1a59d8

SHA512
d6c961dabf30ad5c8790c8f13f69a8ab4b6734bfea1b03e421a477d73ab37648144852d651f48d8c9e8d51c5f5fdf5de3499e0d1f68f3e12c27ec2ef1338c5be

Download Submit