f764d38c65831eaedd4dd8d20993294dc48fcf0fdd7d74bbc535d3f8e22fd9e4

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ceb3c01097fb7087fb91f7a7cef131b8_JaffaCakes118.html
Size

198KB
MD5

ceb3c01097fb7087fb91f7a7cef131b8
SHA1

6978ef5b341a2d24d81c01e09b38c249d52a2f73
SHA256

f764d38c65831eaedd4dd8d20993294dc48fcf0fdd7d74bbc535d3f8e22fd9e4
SHA512

c15599f8d3ac7521722b923866f30da7a97eab2e6c88f16c7f097b1b1406e34eee6ab7a4d66ceec4832ccd821621b0d179f952e2b2bd50e099728e44343d6354
SSDEEP

3072:MpCdFOCYDzErSITV37KHK/FYCWq720YBBOI:MpCdFOCLrSITVuq/FZu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4836	msedge.exe
4836	msedge.exe
3616	identity_helper.exe
3616	identity_helper.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4932	4836	msedge.exe	86
PID 4836 wrote to memory of 4932	4836	msedge.exe	86
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 3096	4836	msedge.exe	87
PID 4836 wrote to memory of 4788	4836	msedge.exe	88
PID 4836 wrote to memory of 4788	4836	msedge.exe	88
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89
PID 4836 wrote to memory of 4676	4836	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ceb3c01097fb7087fb91f7a7cef131b8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff3546f8,0x7ffcff354708,0x7ffcff354718
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12496381078953315753,3187423089435567246,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d96bf8a-c513-4b22-b979-b3dcdc8ea249.tmp

Filesize
10KB

MD5
5092b814c348bc8a6846831dc1b612ec

SHA1
33dd4e9d3ade73832e32afba7e2af2e31a14aaef

SHA256
982a9b696153bc9fffe2837ca93e1ffa9a42077d69e4209e8c1069e0c933346e

SHA512
a391a60c0dd031bf2fdadb507ab81c6d35367e2f12439734ab31a8ae0bcb5bdf846ef8c384ffc76da01c78a7d5b3a922b4171403b6b4efdc4a2d01d2494e7b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6b17cc47cbd5522acb69aae7d4fffbc7

SHA1
9d18f70060d35a9157f92953a5053e90874e19ae

SHA256
c814b27a5b0659230560ee95482e45b9b99a39e0aa1101fa6cc4995c61e8395a

SHA512
50e506e6af3494605615e3a760d67674f6e2cdefb30c3bf91f18e5db5bc009c9934fee6de498f9ff0848d5206e803762ac48b28acf7e0d3a90e042e51ce65a50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e462f17456ae01ba958da124f7827106

SHA1
2c1b3726a8be663584042a9c9563e5bd0df9c847

SHA256
c3d08220d197c6b6bdb27dadc2f9eddecd77c04eb3741ebaf65de4bd01fbdf76

SHA512
5f853d87b7ed2893c51c28fa4c3acbeb0ed49b8e5416e9e8a0fbd0707668734ecef619d26f058a1d2a1231288bd8124e77de46d8ac0c82764f359d3f75496c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ceb350deead0534acd2efcd9f390775

SHA1
9b792e681289138c8536854fefc55a305128bd9e

SHA256
673a34442a5eb0ac6195944bf8d0b08fdea00d9b228524e029d9f51af411d220

SHA512
2b1b14c1e7cf5263911a27b11354a06efef665a70aeb96cd34b353976247092deb0ed23b0fa9757d44662813e996d0c84699d41dbb3e222a30aa3f80ded9b84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d136c7d6d1f1bc50230dda263d9a588

SHA1
d97b357202e1e62382d2381365c6dfbf391e3eee

SHA256
8d15ae23c60cd641314901ab1a3c7b1f819475ffb13c6d5ebe58eac30cb57d97

SHA512
66df0b94c68bf25ae82007aa41d5ad7e4bb23c5a4662b2edc1f077858319ce06f69953980dcd2279d89666933c926beb772e2a6f24ee08d1470b57bed5fec724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit