16a77981c25f1ca16c395aac56329951d37617a033267b028c414bae720856f8

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c264e20896231702a2a99ac5c7bc5f00_JaffaCakes118.html
Size

56KB
MD5

c264e20896231702a2a99ac5c7bc5f00
SHA1

43912d99b2e68406b26e1c51d0f3b7dcb72d1b1d
SHA256

16a77981c25f1ca16c395aac56329951d37617a033267b028c414bae720856f8
SHA512

c336d6a3c603a51df3909e40a6d457c2015358a15ab328242b7819f821c66e83591cc19fa0be8b403ce74b4b5878b7e3634459298357d0f4e5cdb5789dce9bed
SSDEEP

1536:a54TupBvjosgbykYxmqCGFjib7Os1NzjE0Z5O6:a7pBvULyk7qCGF+b7OsPzjE0Zk6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4572	msedge.exe
4572	msedge.exe
636	identity_helper.exe
636	identity_helper.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3444	4572	msedge.exe	84
PID 4572 wrote to memory of 3444	4572	msedge.exe	84
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 1232	4572	msedge.exe	85
PID 4572 wrote to memory of 4840	4572	msedge.exe	86
PID 4572 wrote to memory of 4840	4572	msedge.exe	86
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87
PID 4572 wrote to memory of 2060	4572	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c264e20896231702a2a99ac5c7bc5f00_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe54e446f8,0x7ffe54e44708,0x7ffe54e44718
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14709849271524990599,3988232611314451416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
21KB

MD5
c3a1bf5fbff5530f55ad9f9fa464f25c

SHA1
449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa

SHA256
4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0

SHA512
75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
fcf2c0bc484c4ef1a0db1388c0f74615

SHA1
2b13499a119ecaae8470694035cfb972e73d3c9a

SHA256
3a8d03ca0240fbd28b5efae37388bb3d5a1b04c92cb56d40e0759490b4055035

SHA512
2f79c960e39dc525803125257e65e0035c759b1ead1cbed961271de5b47d8783015e5078615f333c21cc5fcde8d44bfa3b119af68ad17363a18ee0cb6088158c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
00c801a0aafbf4041318691662258b05

SHA1
25d557d0bc5163b79279661e3a50ce5c27577d00

SHA256
d66069be9817cb0d69b9250d432461011279f833c9e72dd3337192fae4bcf27b

SHA512
27e37338fc2dee676fa7f36f0e91521765c943871934e0fe0134065a61ae0c6d2650aaa123cc5ef8c52f0b2fdcb7e10b00d2613987445665ffa9a07be85c92ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ea5e980533aeb87be9cb765a75e48d75

SHA1
a85659bd45716ad01cf09e3e5e7c4070e1953541

SHA256
9c9ba3d5847d020ae393a628c0d79d9394f7731f18b112fa31b5eb1a62f8b023

SHA512
33e5c4f1adf63c8a4bb809ba77a2cbd7fd2c37b98726a88b427fc643f8b88cd7cc3374ae7345536bafc8d618b5e0e767303224305d55a6b1ab4f34f210830c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ee011bafee601c4ea03ac3ba16a7daa

SHA1
2f727a7bc27beb441ebf0fbd4224a9351cfd5a0e

SHA256
189e26768356bf14c4ccc2190c120e6ddebb9bcc2584c23ad6a2f0e2fdf5bac6

SHA512
9f28e9cbe8c7086b61313673d2b639c5b214a1d84134eadc1a697b1a3c3057b1f4e7b913af1c3c580430026a5201241200b49dba98677ed0ac909c583b418046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c05aeada385014103418984c2f5e490

SHA1
555ddc8e715d79ebbe46b100260c31c4d5ffa04a

SHA256
ab0267723e45ae44445e896db8323cbefd62cccf5ed39cca532d884b54fff7b5

SHA512
49b65e278027adc04145dab25ca37128ba274a203a886da0236144d0ea2f75b29b98b9aa3f382682a182122e2a498ca9534f99266f484c1c60108cd4394cb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0f17bf5ecc1ad5f8ec57915ed024b8f0

SHA1
1f9a3da0b0d95b28423208a6d04b8406c7fce81c

SHA256
347d4511ec9aceb6b5de6405f85542accc14ec4ee33ab37478ded051223a3816

SHA512
8661c38a83737d8a667cbbaf23927c0c2376b9d0cb6c7f291d9aeb70f77fd11d76ef7e0e0ea16242fcbbdf71301c0121bc37472dc4d6774bc9f1920eadb2e68f

Download Submit