067c028ae7fe57220bd8a36bc0480bf289e5836682b885f99f14791f409ba61c

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf7cddabd08c670d19c32ec53311688c_JaffaCakes118.html
Size

15KB
MD5

cf7cddabd08c670d19c32ec53311688c
SHA1

57cb7e1fef4d5851cee339c9af6c6f1fb732eabd
SHA256

067c028ae7fe57220bd8a36bc0480bf289e5836682b885f99f14791f409ba61c
SHA512

adb092ea9a33916f318d75941226060eca34ce5256749693d2528f6246883f8e243b8f9da2adffcdb3232580d4314b0217bea48ef611f7d460acefc42e96d562
SSDEEP

192:dcAvJxPP00TA7lxMys0ow28456v0ejunXGe8ofDO15sLG40PJbRS7IIKCmRo8+2v:eYxPMd6ys0oCC4JIIIvmG2H9nxaCPBOm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
3212	msedge.exe
3212	msedge.exe
2692	identity_helper.exe
2692	identity_helper.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 548	3212	msedge.exe	83
PID 3212 wrote to memory of 548	3212	msedge.exe	83
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 5076	3212	msedge.exe	84
PID 3212 wrote to memory of 2744	3212	msedge.exe	85
PID 3212 wrote to memory of 2744	3212	msedge.exe	85
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86
PID 3212 wrote to memory of 3076	3212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf7cddabd08c670d19c32ec53311688c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe746446f8,0x7ffe74644708,0x7ffe74644718
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17808929708887185606,9038287955846328631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
bc869c2506487a293eae0f507f65813a

SHA1
a06a567d49a84bb7f1bce5392e54d3763015fa90

SHA256
cd1fa425cb3a02f94d7b53e92e850cfeb3a1583d3947bddf40820bd4f263bdb7

SHA512
f2a241d386aff3c2dd43f99fbeb6d3c7be62531f64aee373b612acdec8be04455fc72698bf08e139be059b42b0231bee59aafb1c4e6e6adfd7164c115969d433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
700B

MD5
8a6e0ccdd7704a4ec4247f65e128cdaa

SHA1
48014debaaa3fab78bebb4d75e6119f08d075c91

SHA256
ae61cd46930abc52a9a223eb732ef829aa5f760823cdfd59c4821dcf57c8e4cd

SHA512
3396200e2e83104c0fe6696bb16947890f154284cea94d4b5a77b7ca9f75347d9160806742bf032bda86e83630b4adea41a7f00127ca0b47ad62038e0ebfb1de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5d5cfd24d2b1f23a838ae94e159273f

SHA1
36fca6a2013a0a3d2a711ca3faa2602c503c3afe

SHA256
9b1138554ae1147ade7750eefafd425ac5b9f6b8804119482fc3ee08aada9c6a

SHA512
00afab770a7df7169ae0cfdefb05470efd1932e5b97be19c301cd025a719973dd7e8ef66895277853c439660468061b614c99024fa36c8ebb2778c6e0fb84825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ceadfdb716c680d7863b4431af384e76

SHA1
59756a006b9178c349cd2ad3e8f1e958d26d3d78

SHA256
2f082d65ea169dd59cf6a09a5b003f6d4cf50d11146cc53d3a3c6c42f7b223a7

SHA512
a7c5eacc951d4ec3ea1933d5be85e855b99d682abad67f43909456d5d60a8f53dd4b2f3c7740efefac27924c9b22f6548a3e5c84d95be12895796c45c99d0579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d9731a555ca7cd6568eb58c5c46d585

SHA1
6a11ebcb36cec0b2b8c13e5381abbbd6b68bbbb0

SHA256
17caf8faa2f1caf48549fb0c2082377bf9e7361f2cdbd918285c5f5d64a4867d

SHA512
08f963143f82ad26f3a2d15508ea596d868a7221852edc8b06dd5414db090f9f5f75457a41fe4652aa603ab75977a2a0ba7d9685e2968ca3cc4f66c2a1c721bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c2c631033434b307891eeececb7b8f0

SHA1
ed155ee5a4f09383ca632fd70195ceb4c4851528

SHA256
de58e04943b5a8feefae89af668150e401b31b2c2a162df922b3a1b0ad40a72e

SHA512
493560e21e7ac7a815ab2c6e5a52743ee89cb4a437551e0f8f207fb86777ab9566f040893ffc0f15148f1000571778125d0cb88d6d4adc0d39f616ff58880f84

Download Submit