d13bf7005b7ed16145d73ecc4b78e7541c45788b0e423772aa544060494b972b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d36015182d8d2171307fcaede0cf6248_JaffaCakes118.html
Size

57KB
MD5

d36015182d8d2171307fcaede0cf6248
SHA1

6082f2498cec7976f581be161614b17b2fad6c6f
SHA256

d13bf7005b7ed16145d73ecc4b78e7541c45788b0e423772aa544060494b972b
SHA512

3aa158ffddbe01d0d07d8121e550ea85746376fd7ec64a16d8dbc99bdbff2787bd36947604da22fc05b44a46b98a013928db27f7c44a906e2efb8d04045dfcda
SSDEEP

1536:ijEQvK8OPHdVAwo2vgyHJv0owbd6zKD6CDK2RVrolrwpDK2RVy:ijnOPHdV+2vgyHJutDK2RVrolrwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2868	msedge.exe
2868	msedge.exe
4892	identity_helper.exe
4892	identity_helper.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3148	2868	msedge.exe	85
PID 2868 wrote to memory of 3148	2868	msedge.exe	85
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 1724	2868	msedge.exe	86
PID 2868 wrote to memory of 2624	2868	msedge.exe	87
PID 2868 wrote to memory of 2624	2868	msedge.exe	87
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88
PID 2868 wrote to memory of 4572	2868	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d36015182d8d2171307fcaede0cf6248_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5fbc46f8,0x7ffe5fbc4708,0x7ffe5fbc4718
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7525364322967473405,6481487437815122867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
5d7842d6ffc860255cb94f22ea907363

SHA1
ca1229d7bbc7e11163b711b2d4d377c1600e5774

SHA256
39890daebd40d734775f01a3f29064aa7422ad574526905af933755a6893c8be

SHA512
88656ea6597c5b4705091a86fc602f4a494b7dc2f01110dd03fd3833f2ad903106ecc1a896e6e75aa651b7f56fc2443b441217bf18f00d06ca896faef9ee8469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5aeca5f3766089333dff521602dd1bfc

SHA1
1098e4c8829abac81b38d399c0ad082e63bfab2f

SHA256
18643ea674958967ec6fe3a40c76ef7c8b4b0aacbcd677ff15cef01f87466b8d

SHA512
94ca4acc3bcc9e9657409123d4cdd7943080704228b6bf82a3fdcaea1ed41374aa5e33002231807e4b3b7745b32178db4f53b759f7087ea180ace41806ef4737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99c04483f6a88c8a1548189f7a8e28b8

SHA1
53208331271b351bf1c993ddfcc23b401b155284

SHA256
a87afa3f08047c7254a9438dba1c0df85e9f6902bb952fba33411e2c58630092

SHA512
7a0eb1a376ee7aad4fb841eb347c2155149320cef47842858f8eb5054aeb2126ecd76b04b30fce88bbb132d6d242cc434e33940e9377c121738b54601592dd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0046d55d651a39fc929035db33ff86c5

SHA1
f759e4e840a9dec7194aa3c343e957d6d1257227

SHA256
c9204e9c9a3c05b4a9829773fc7bbbaec7de7cc16df0cca6be3b917581373696

SHA512
22ad08106dbad190f70d71eb1f98f0b30566d2ae465247a33598e6a6fbf5359d421ab8cd40514fcba72ba2f68d4206c94563b55262d179f507e081ffea487c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddffea69d44552a6ba1901c0c357410e

SHA1
71862de9e30f9439feb3bfb41df69ad7e0ebc7b1

SHA256
02681440d84954518a36fd13ce7cac4e583b40ffea87fc967b66c6680c06c8bd

SHA512
c8a25d702cbf96543199df19d7d53a1eed0ca11087114203afcab29b14a7c36fed2cdff30e22708063abd1cdc6d49f91727f17eb5703e72fd150bdd8270865f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
779b21dc26c9db6892ebcd64daae1908

SHA1
c4435ee9708b2a19a150d335d8c221aefea8d1b8

SHA256
b6b75cd5a114e739373d958547267899008213a89a26c64772be6af90a95b4d2

SHA512
26da193c089d062fda8fdd2aa1ac2831ba443c248bccac1cdcc35dab5215433248a2d8ae752b79e9beaa05c33c74f0a2e1c6c760b5de651fc6c157193ca71e28

Download Submit