2d8345de4ad825ec7cfd0bbf89d1ff61ee10db0a3712d69bfb1f44cc33308e58

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96840b882c18c5ec89cdcd18a3c0148e_JaffaCakes118.html
Size

33KB
MD5

96840b882c18c5ec89cdcd18a3c0148e
SHA1

890897ffff0da51922da127b72b971cfe203bcca
SHA256

2d8345de4ad825ec7cfd0bbf89d1ff61ee10db0a3712d69bfb1f44cc33308e58
SHA512

060852641400aace9f4354c6725688685816bc272685dcbe632bb74b0c80539c541cb9d37baf590a22a1a7bd06fc5ba7f0cd1b1c0b12f0aebd828a58e8f62441
SSDEEP

768:SfXaFZK0WtSQd/cS0BdWGbNUmgsjk35bN:SfS3vUmgsgN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4824	msedge.exe
4824	msedge.exe
4612	identity_helper.exe
4612	identity_helper.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4640	4824	msedge.exe	83
PID 4824 wrote to memory of 4640	4824	msedge.exe	83
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 2624	4824	msedge.exe	84
PID 4824 wrote to memory of 4088	4824	msedge.exe	85
PID 4824 wrote to memory of 4088	4824	msedge.exe	85
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86
PID 4824 wrote to memory of 3276	4824	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96840b882c18c5ec89cdcd18a3c0148e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9da7946f8,0x7ff9da794708,0x7ff9da794718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2273898590149205899,6223922084707023805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
72a741da9c1dc5c8fc48d3c5f7d6cdb2

SHA1
6b5f878266681cb7dd14a0b9880bb4284d1f441f

SHA256
bf081670ff99d7ff9d34f87107a398d71de80cc2ca5ff939b8a6bd31540fe2af

SHA512
e059cf3ccbb46ffaa93f1d32e3dd2e8c74ed276c94b22b0a5c0406c03aaf7ef6c5934d19d1ae162dececa2d6f22bb36938da4d7af6c35ccef653f7cbb341a159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4d6f97881de403a03a003cac7900ba6b

SHA1
4d80aa47bdda033b7459fd04b232ede72a471cf6

SHA256
fe48ddc1a38d8b98513ca98d171d7b0404d7121be86428a63d8ad3a79f8f8e99

SHA512
dbf1e2820e13c0e5f4d06e0a073d48eb9a34dd1d12099765257a508405fe499f2cd2f75174ce6969d9be4f011b925d38c1beaa0cb6b877ee6c3496d113c1b0b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd078ffcccaa22e96ba65384f7bbdd10

SHA1
6ac7faa5af5dd9a09038c479c0b82b715027f4c9

SHA256
c9245d28fbf90d1176fa7bba086662969c139b06129611bf543e5f67488f31db

SHA512
13ad5ceaea70fc9f6e0598f3b716557aee4b6cf72f990e90b089d56ecf0f0363c56b28d3554040d37e0673857d8b772a4929895527f27d270e30c925eae59fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3aa80e1aff42dc65def4b612d106f21

SHA1
6d1f9eb33c8759e8d9a3cad5dda3b707efb8172c

SHA256
e241c50676f5e5983ef7cd29428a80239df05fd002fe05a019a49495c0b0598c

SHA512
6a9627cb9a0a5b3f5fbdf0a6c2dc98ab23d19ab4dff7310461567fae0a826eb0e598266eabab010b11d008aba37aefd08567a080a4a41d5cc83aa4538d21a68e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d87da50c8973295ea231699e9d0d33e6

SHA1
7d5ddd7b979b12811cfd775b72e0d5409cfdd31c

SHA256
0fb939a9c8a219d026411ece5219e993a66e57828527be6f5d893b9f92837466

SHA512
7f7457b743a47e9dd2522e4d0a468a123b42dee860b1bc2c0c2efbac9141f6cc1018c0b24f8f541cfe6f66e4d82ee0aa5e316611b376607591931a58b74c88f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c6f3f079541ed75d0d641849f37b4a51

SHA1
529cda39a0ff51ce969dc60c2e885fd3e0161a3d

SHA256
3bd9b622167f3f2fbfb648e68c6e198e19bcd356290379a75b8b44d5c962a22b

SHA512
74c8a27114a851ea58be92617245fa183fa898817a5046d3f120a1d80c892cb388c226a4d7d9a6f8bdc4662f6deedaffe99b26d2e1e6fc03ded05c3d1c5728bb

Download Submit