cd274b22f5c5a3106534cff21a057607f24dbd58f56855bb9840637e5e2a3fec

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd9c9034220d31b4f95b806078574273_JaffaCakes118.html
Size

52KB
MD5

fd9c9034220d31b4f95b806078574273
SHA1

a2dcf526672a12ab70d7125909eab6e4b90ee26f
SHA256

cd274b22f5c5a3106534cff21a057607f24dbd58f56855bb9840637e5e2a3fec
SHA512

8c44c66554572e9c8fcf908e35278c138ec0860f1c821c29a317249cb20e3099d25d4e6e0ef5a8c28b414a5a6d62959e66353ea322cdb3d406656403251618ed
SSDEEP

768:vCT0EipB52c2v1xF7jtcnqc9MRZpEyh7t2a0SFn2SCX9idD:aTupB52c2v1xF7jtcnqc0ZpEbwF5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1140	msedge.exe
1140	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4300	1140	msedge.exe	82
PID 1140 wrote to memory of 4300	1140	msedge.exe	82
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 972	1140	msedge.exe	83
PID 1140 wrote to memory of 1236	1140	msedge.exe	84
PID 1140 wrote to memory of 1236	1140	msedge.exe	84
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85
PID 1140 wrote to memory of 2292	1140	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd9c9034220d31b4f95b806078574273_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb6b846f8,0x7ffbb6b84708,0x7ffbb6b84718
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1350496374261040849,11167606630379090135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\268dce22-ceff-45d3-9c6b-abd46bc4c366.tmp

Filesize
5KB

MD5
ebdad07e1b4a462ef98be780620c889a

SHA1
baaab568c8045add2bf70125ad76ddf9438d8b3d

SHA256
a7881256e222ab44772eb6a64a90048fce5e55e582f7ea05c9ac9eafb5d64bba

SHA512
61df15967132ac752cda7f70335f18d5ec4cd57dbea967137a6962d52c19f7d43a8f2ec31e7c8179ed4b1bb8e9abf02a559a8e7d8ef6f7f70cbfd46f7e4c4b2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c8f4f774e896adb4694869e0860028a3

SHA1
b3492f79d7cbffefc17ebd51ca8261ea59501866

SHA256
e598f7637241dde268f0032a99e4236b3e29c4cfaeb9e0f98b603fd39fa5ba36

SHA512
bca12caed4027719fb9be186f7be4dc410dddc4a02c3f35111bcabbba77d17458a13a0c36a82d851b9ce5eba4125d07b8aba186cc699b615d716c8a819a2cc69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ba13c297ed3f464fb31f5287db64d3d8

SHA1
b4b3d8831609fc9ba254ca433a70306dfa0f95e7

SHA256
4cf158eb8fcc336d6a7e0d427db05f80d36933f15abc5d01ba2ef65911eacada

SHA512
08497504aa436e3f74b081c6ac90fa9a170c445ee40a038ce8f09f16314c9347e5b2b89df04d2e837727e757b657da4f2947ad04f4999444e8cc11f4688927ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b1d0465ddb14b4d490c00c2718449f58

SHA1
c87a6f02273e5c1da15f2c0ca83db5fb1a5fc244

SHA256
1d00db35739ec616f74e72d158702c561cb11e1e798eb61132295d4a76331b78

SHA512
fdbaab4096896ad75a7b57696bde3fa5edd3dde25edf5f1e40928e847ee67cdcbcb7488304e14f5563709044eb4b7ce69697d06a81e5988b94e001560ba3ca92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85bb8ff7120752a3ad7b8dc4081496cb

SHA1
605aae62bc7ae9992442ae1ecf6d489f5850d597

SHA256
1d12b2c21bbffe281450eff04bbb10126e564940ab8b60fbb03550f788c744d7

SHA512
da2be4544df8a1aa0e4f3fcaa03263cf1cffb89592d5148d0d0ac89982961c6aab5a9d5020c32a617b6d09151f221c77b772fdcd0ea12021e3f7685ebd058451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2aba50298be47dea307979f82fc5ecb0

SHA1
cb3ddc77cff42a3d7910a7efac5a0b1f039cf06f

SHA256
adb309e3e1d14942d09c3ffe7282febd1d9afac54c46d0784d682b9cfde1689d

SHA512
7d23f0676f0b2b541a037dfc8a035e7a9a72c2fefdd485a7bb020172f673cdfc9d2710429562e23dc12f3a4ecc7b1cde5ce60504d8568e59e271cab7255239e0

Download Submit