2d00477c6698c873154549a2f3a988a5a641497ead92dc0ba4336851c3709d26

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af837debd6a8bdf2662dcd9b818e8ef8_JaffaCakes118.html
Size

175KB
MD5

af837debd6a8bdf2662dcd9b818e8ef8
SHA1

52fbbfd972af56407668c2d60739ff957f8a3579
SHA256

2d00477c6698c873154549a2f3a988a5a641497ead92dc0ba4336851c3709d26
SHA512

632b64c60dfeb3e6bb66a261dcd3728db34da448221a4447cb68bdceaded5c0132eabe3222c8970fd460ec70e0485c7ba17251475e30dc26154f4e4aa9c0daf1
SSDEEP

1536:Sqtd8hd8Wu8pI8Cd8hd8dQg0H//3oS37GNkFWYfBCJisG+aeTH+WK/Lf1/hmnVSV:S4oT37/FfBCJi4m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
4212	msedge.exe
4212	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1276	4212	msedge.exe	81
PID 4212 wrote to memory of 1276	4212	msedge.exe	81
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 1044	4212	msedge.exe	83
PID 4212 wrote to memory of 2576	4212	msedge.exe	84
PID 4212 wrote to memory of 2576	4212	msedge.exe	84
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85
PID 4212 wrote to memory of 1652	4212	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\af837debd6a8bdf2662dcd9b818e8ef8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe473b46f8,0x7ffe473b4708,0x7ffe473b4718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6512951127802730877,18205807364100089366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
b7dd1ee250c06866854c6983193e589c

SHA1
b8fceb163b32835edb69aebe93572c836bc00ba8

SHA256
7709da926ce30c5eb9a71552e5e539c5983e81a6e42332c51770070b8b7b6fb5

SHA512
1f3e438c54d85077512804a648a5cc453c0f862ec35d780176cb73f79ae321fc0542233b6e27990554070295ed769a23ade6ae840d541cdd6497fdb6bf960337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
2e5ad63364d25de537f37e6eacf8b094

SHA1
937a780ecfe6c07b85fd381784b631cdcd4144d4

SHA256
5f362a85cc7564d3115e36ab842bf2a6ec700ae86f58e86adf419a34e069ae00

SHA512
da8ac8c8d286a90a08c2f7653b3a952a9938fbcd36226a167dc3ed126040ce552c7766518f2ab78f56d924ed12c5d3aa1623800b30a09d7e616afdda939b295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
031d6881d0fe84693c550caf78e67ee5

SHA1
e35757e9ce176cef50265824fc6c97e692ef993f

SHA256
d9cde4b3694c1c0719192a3a0adb82ba5aafaeb937a6e0de5e3b76b4af930147

SHA512
f3c1bb73c78eb858fbfe86bbc948152279fb6539febba585e2ba61eede50b3f555b83e0056433ee401c66f710b1b8fa781f48d3fc40c908689a16f649da6f462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8d743ffc861c585a74139a70dd606040

SHA1
9ec3a7621e3e71d428c51b471ded37047d01c6a5

SHA256
d22cbb81a397ff4cf73f0cfa9bc2146668f2f66d1ca470a01eb7c0eb24a131ae

SHA512
940320586cc6be53e2039ccf1a574855bb5b220d799e12f40d11f327bb3d6b894f6ba47ba744e1e0ea9310a3ec885173ba9fb4fa386790f25f84a8c5f2797385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
988337d4d96eaedf5bddfe046afaeeb3

SHA1
f992087970e2fe68ff27c52f4258601a15f9256f

SHA256
6ea75986e061849ae24c650d0d146fccfdde8af4b81323fa39df741be5c9a55f

SHA512
448e4b42a24a5840c67e1c5e1105d67434a99b2ef137ed85337c715fbc275f29be6c73209b633b1ee61541ff02fb328c93fe918ee8d9fb503bfde8a8209d583a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3ce5afdcce5649e42d9004ec457c6b39

SHA1
2903e4bf1ed49dcc0f3f7e448e5f5bab8c41b9ce

SHA256
0daf6e1db2db03d6301f1573753c967a8b64fbede411619731407f2135dda40d

SHA512
a0af9a77cf4bdf8c6fce4a4f8c7f6695f893f31d6162360240b20332728c8c98aeae94f0e14bb7b0264f90e2bee273dbde215fa7fc3f2be21e698ab5b040d077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cef70c894c9f448e1828df7f5bdd2418

SHA1
631a7a8ada3ec5ab6a56a897622386741f469d4a

SHA256
b21df0223eed98da3c275ee96e7f445f373e8c89425e4a7de1b9057d9b729a4b

SHA512
955cfe7f2994cb2ed36a623b688321fd0d7a579e1f38c51ee9be6dea5eb2b9b6afe7c04ca35cfcf1ad19a5db8fb4dbc698c8f7c4e689de2248a3e5caa180c410

Download Submit