c76f721f7993eae784514a7b8baede9fda3c545dcc33bfae95fafc4024297994

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86779c13a73eee8e311befd4198b733d_JaffaCakes118.html
Size

175KB
MD5

86779c13a73eee8e311befd4198b733d
SHA1

b164e3a04531e1ddb41ac86dce15325f065ce6e0
SHA256

c76f721f7993eae784514a7b8baede9fda3c545dcc33bfae95fafc4024297994
SHA512

e5a55e530220df5f56a97fd222ececf1a805358170d6175455f6d6fc90a1c724b3e15949c4013a06220c7cf6e465c68dc453b5c9c174a1cd90664265d662ac69
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3uGNkFiYfBCJisw+aeTH+WK/Lf1/hmnVSV:SOoT3u/FzBCJimm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2568	msedge.exe
2568	msedge.exe
2728	identity_helper.exe
2728	identity_helper.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 3200	2568	msedge.exe	82
PID 2568 wrote to memory of 3200	2568	msedge.exe	82
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 3220	2568	msedge.exe	85
PID 2568 wrote to memory of 2848	2568	msedge.exe	86
PID 2568 wrote to memory of 2848	2568	msedge.exe	86
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87
PID 2568 wrote to memory of 1704	2568	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\86779c13a73eee8e311befd4198b733d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d4718
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8480109867145534735,17191104313523734436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
29f1a08ac4ed761a2f3ef1cf409ace06

SHA1
73b507141249422857f0c4a247185f67379d365f

SHA256
e03db7cfe001764267e2c144905e47ea4200f57693d0bbeb8beac90f0b4b22e2

SHA512
ca843d95d55f9d82eb135f4c6550f8cddd1715f78657cd8c48984bd8b7ac69a90e78696e7d115ddd8cfa32c97e608e830276b45ca0e0df067b49e622cfa3db22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7473ad24a740f28805f2cc51e97e006f

SHA1
827d2424282d862225b5fcabd97b482b9f2d0df3

SHA256
50ded8789969f41900d0199087b96108767cb765552edc6d6c4af813136ca740

SHA512
1c6968144276ea4a3aee8cbf906e1722bb51eab8b35e8ad1ed6617cbc25e7a9bf2b61dfca134cfc219ed88698e6dc9a0e08d8c32d680d0c9acb62540d6ab6178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
174d7f45380ed4fb7eefc363545160a0

SHA1
151a586489e3915580d5a8b2a519966ae8f2cdb0

SHA256
c2957562f7cdfa68b5de05df9be74abd22facab8d083529bc3d9f32ba6ec63e7

SHA512
f8edd7415af03492944b155488c70db83c655e04f3999bccfe805bca91e9478f84e8acd3ef31bd5db7ab49c1687c41b59acc6be7da58cd4104fb291174727670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5c6908d967ce47c9c7d14b4c2bb1e8a2

SHA1
9957c8ccccf596b40e39ffbb011ba226a9e10f39

SHA256
733779b21ff666c26ada4ec7726d77fb5f9252bf1eeea0949487bc9a379810e7

SHA512
52e9dbcd706f8df9837fcebd97dc09cde736e1322c4443d290371e53baeecc85d4772486a13bb1818746f924973a4ee5e3dc4734b7abff9e7d15b4183eccf869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68867a32199c459fd241637e06eadcef

SHA1
4df3123ae883ffb4785818769867e26e47b03f95

SHA256
fd1c18e1642dce7b117cb3d8f47ea7cffe6d9c303ec22095af6cd3b2d726710f

SHA512
98601a7754dd6f7cd08f0fc235cf75f3aab22f79463700cf3c549be701cac0ffdb592c51a43e2c3fbef702cf53eda2ef91bedd23b0b55df39a0b430cac668436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7426604a6c0d3216041d0fb3b3ca1d4c

SHA1
6fdca94893e376d6070680c343e2f4851e40c5ec

SHA256
0d8018fd9bad46e1a718b178e1089c410cae542eeee44960fc28ec70e2fd8b45

SHA512
ade1dc2da5cb21edaec73f66ce8cc1ddce7307686a8f7a974bf8bd6aa60a08ba6d089190cf8b04ef79a47356d392f9bb0e714634256f80b84b121335e19441f5

Download Submit