9164d1318e49c0ba5e59c2aff98c853d9479e142342867f08cccb764b385116f

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bd63d954f1c6e56df2bab82f900f308_JaffaCakes118.html
Size

35KB
MD5

9bd63d954f1c6e56df2bab82f900f308
SHA1

b43f6e5a5db2a9597f6d9397b4a51f22919d11d4
SHA256

9164d1318e49c0ba5e59c2aff98c853d9479e142342867f08cccb764b385116f
SHA512

8d794b5bff4be11d3e1e8853484557ce1353bce23ba6a736134df9b8124ae0793a7ecd8b9a2a3f0cb7ffc12e415f07368aa445ee833d3c48f16e7a078dfa3815
SSDEEP

192:ut31yeRnAu0PvNpqNtNUNeBKU8EmxjZ8SBbyDZHk6sU5X1+QUFWBnb35bsbUmbJY:ut31yeItEAjU5lntNTHuaBEHZluus

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1188	msedge.exe
1188	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2024	1188	msedge.exe	80
PID 1188 wrote to memory of 2024	1188	msedge.exe	80
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 2272	1188	msedge.exe	81
PID 1188 wrote to memory of 1072	1188	msedge.exe	82
PID 1188 wrote to memory of 1072	1188	msedge.exe	82
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83
PID 1188 wrote to memory of 2392	1188	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9bd63d954f1c6e56df2bab82f900f308_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8daf946f8,0x7ff8daf94708,0x7ff8daf94718
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4202229174931221975,4916699097368822287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e995e6cb14e53aa21fe87c6d79f39d59

SHA1
1ba0dd9e700bde1017480995b41c5607c45526c7

SHA256
9e5aee0abc39be4001222fe1ea0756140598bd885eafe16ebc819198293be49f

SHA512
59c51ba340be843f03ae2786ec532eee1373dcb646c4e9f652cace2669742c4f55205306e7f3d164e2dd9adc41ccb355273d80c7b1bd5be707f0f954fe4e95b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5e3dd493bf95d6d70c1ada364dddd064

SHA1
13aa060b46d78de5d12a9a9a765b8f919479e281

SHA256
1d318a8adc6c5209c6696bc3e7c1c830bd7e14d6ccb4d562c3ed52d4cbda8ca7

SHA512
c5a760bf680b2b5e300c309ddadacf53583298e137bd84f861a93da90c8ce468801bc2118f0d84c37b469b17122f99b71504be20a660d1d9cd9e3c197f38b329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f45d0e933274b03feba25785402c28c9

SHA1
51ed0faac3a88252b068c8b4ba55044baa0f8333

SHA256
c00cd4e97554fd5a0372a29589973ee0e2a49e4dd3c74c7eb72a31698eec5ce3

SHA512
c2f65b8cc769cf530532349d0d840ef3c11da30f6dd6daecdd84a07acc0223bdf5495170fe7876f07c6c0857880ac188f9ab791c21c4bcb7cc79824070e9149e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c9770e0a02b55c99ffb0a9b68bc7c0c1

SHA1
7bc2962aaf1ab33ddc7bf7e6c985974aca7fe591

SHA256
73483a11eb13ba6ce72460d7de602fce97906cc0680b09ac8282a0fea3ecaeb7

SHA512
fa79f421b8d470077d7ab0c8052b247a24f05481f4e2bd846ce09fe5e715cc706ac956c161927ccba623eb00864b58a1e13af22c1e55326144de38700613e208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9696eebd8ee54ff581bccf89761bd88a

SHA1
0e397379799bfa62e463a253efa018b60580f7a6

SHA256
3a1fb0218859008d1903409b1c1c0d0b5705641acf3b69a8199d485c51fb980c

SHA512
36ff75ae90f4ab69c33d660bac9c087e603b336c24ab4ad621f98890226cb3ddc5481309f172119e268ca47d364140a6b535e851bc43f6074ce5d1f387f3a2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
daea87b13341846f73c008d733e5d3cf

SHA1
a0e31ae0f54d314a70871cce030c5b79267a8348

SHA256
bb4ddc359d2d016cf88fa4c3589109c3821c9271167a55b13afccc9e63516902

SHA512
dcff0640ae6aeead14d2c0efb723c2212977d4ea60181060df58bac3a52e182356f2bd4fcf1addfbd27281f6f25923384f55f20b40a6dca5ee33179e910839fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
771d5bcfc59ad67e7306dc1e7e6971aa

SHA1
1e030882a7f90a04ac6e38b893ed06ddc9e96799

SHA256
ef487e241980d4c248b96d0f7608285594a3f3c6e5f5e2da91ac59add7d4936e

SHA512
94556fc1474bed1eba9394d5325b3edd65c9233984807fe7173e0a4d44e3705ff639fbc0bef0602b44311da778ef5d4c8c89a8568c8f518deceae78bd4f9061b

Download Submit