43d3e946fe978ddda8131574cb39e0a634e08d67df8abe363c321e69e72fa98b

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f4f93f6cb2f60a458b17151bb48849ad_JaffaCakes118.html
Size

124KB
MD5

f4f93f6cb2f60a458b17151bb48849ad
SHA1

28f4c9a041107c14d925512182e4bda0aa5d92ca
SHA256

43d3e946fe978ddda8131574cb39e0a634e08d67df8abe363c321e69e72fa98b
SHA512

9b69d3806814184e488b2aaa21bca685950e48702a94a5312b9a8b6f34ee9f8b617fbf26531a3abb2f32ce5cfdfe555f410943a88497db7c37a745f059ae4e73
SSDEEP

3072:SO2ALze7RM7NMrXLf9+OWwCOuF71BZb7hUCloczB18jj:Spf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
920	msedge.exe
920	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 8	920	msedge.exe	87
PID 920 wrote to memory of 8	920	msedge.exe	87
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 2132	920	msedge.exe	88
PID 920 wrote to memory of 368	920	msedge.exe	89
PID 920 wrote to memory of 368	920	msedge.exe	89
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90
PID 920 wrote to memory of 4248	920	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f4f93f6cb2f60a458b17151bb48849ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8184c46f8,0x7ff8184c4708,0x7ff8184c4718
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,2259652036869290726,4425269557147005687,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
44KB

MD5
57ae46a87a9955c7c61ce5cfebde0bf6

SHA1
2a9297a0e2ee5f4e0a9b1de88ffd2121d5d2ca77

SHA256
891dc8b9999ba1b2d25c1a044b49330b66b86f986478282f4e5950b726e9878f

SHA512
34e51215e347df35ae4cf8420e2148420780f78123a37450682ed92841c6e1dd1635317cae1ef925a001bda733228db0f5de87faa0a10c36cb967e9b70691689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
ba691d418722dc34ed339ade2b6e3b88

SHA1
d1a43371163b84ae70cdd8b4de1dec969b8981a3

SHA256
b8b9612c11979afce4d5863bcda8ba71bf456cd46a5a6687f1632bc1662bcc6b

SHA512
5a1983885f83c076b86cbd9e793f196281a65564bf3e401c1a40e1f9c6e8ace8ed332b19b9d578a1d80d89b0cd72d0a2320ce7eb79d545a2f88c676a5e753f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
11969435b7d3e106e9fefd31ab3eb0b3

SHA1
6bc78847a14d4753867567b3981e34db16cd5c49

SHA256
3a0b996cbbd7087ee1d3622a7c6eab2177a55c24a8dc4fd9307afe673539856d

SHA512
e1c399e359db0baf6371b01720f6a03714a3391aa1f7d9611950f6adeff559f352a7cdecc37ec1d60e2a83fa810ee7c4cd2a5b6ba21d37955c464f4ad778e040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dedc667c163028432d0ea3b96719b8bf

SHA1
0745d5aa265e7f64a17e4e8b5e23c7d1bdd03338

SHA256
b94a929592ac5734ab19a12b3b9fadcf852ae1af3eb34b1bcf2bcd0849d4be97

SHA512
3a934cfc2936ae45a53f86c7cb1bab04281245c68358f6575b3b977d6c62033e7e31a561c3341b6e4989ce4a6c3ab5bb3b8bafd175b6d0f3bdeeb646587f127c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
302353aa1004ff20edbde3cf7a045132

SHA1
ee7da5128a078501167c2fd5ce5b8d8930f2e8c4

SHA256
2bba90761eef9e6265f0440152978c827c6325fcee4fce28636b4b67d481a1f7

SHA512
2ae09a98de85dfeb97ffe72fc29bba3af31e721d32210a7fc6f0c25df464bc84a1d4be6a00afa1720721fb7aac64b71ddbeee83d85748883a0282161b990304a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
02c378f5c34a21664e9f2b6c06cb5b94

SHA1
5f315fe5759bc25b6e96e211171d2788beb8b28c

SHA256
08e5cceb55770342642f762d0aef576d7f1ed3fb300fa1e7a640b0692ef7d237

SHA512
20d053e265f0c871c75b68032939325e03fb79fec8560e1db3ef825c5d7f90ae554cea91543a49456ea5895768730b015546996ab14cd45a2584af3e944a1dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4a322b6fd33781d2d29061be12b0a8c

SHA1
4327d7c5b89deddb95f9c35159526fd76e7bcdd1

SHA256
0ec188b7a00b42c97a023e64c9d61c7186ee1fe868f4d2de501897f27b951d9d

SHA512
f4b738c5779e03135bf5faff56149987b6d2409f417393d5dd6e9269f8575c357d624d2275293153332054bc684b57fc82affc83376c10f6cb0268bf149568d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
16554607b9e3190b8ad7908b539dfd64

SHA1
ce7e15265c84033b61a3eaf304875e592d9f9736

SHA256
1cf519a0bccfbecaf2e029072b70b7cefc57e030328c91de7b8f0667646211d1

SHA512
93bfe8bf4ae9682a6bc2a2c280de198cc2b53fe71bd2bc5d620f4c21c1d8f09f4cc503c0c9fd1ad93dcbe69fe275190b43a4345b90479f16d67ea74531a9018e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4663d247846cb94531e3475f5760df7c

SHA1
9611b113a6c25d36f2f1ef42cad28ada560cce71

SHA256
ae8042f029d8509876f216d6cc4bf3f8cfab1e6811250bef67a1bdd36ca690f9

SHA512
ccab61c753b0466cb82ef7c297afb925631393170b3788b1abc476c7bd48c07b7f57ccefc5ddbc3a663bd1f104a7191af61f766d0f25fb98d5dcfcd12bc2d0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d39fe88c-0745-42dc-99f9-7edb9fb43b46.tmp

Filesize
7KB

MD5
ae7098e68ad3270b3caaafc4002bca0f

SHA1
ab203ec5c41b42efa1e79d2243b4101ca76b486e

SHA256
acdb658227bc5872bc136150151f259143011bbe86bac00b5e54ce607ac26dfa

SHA512
3fe372859beac1f539112697a4a20fe3149970dfb22c40769b5630a4e165f33b444ce711eb855fea12f0edf453a1c43696b83f3ddbeabf72e35cb12b9843027f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d1caab328c02373b9b6566b8e61c0bc5

SHA1
8c2d9111bb7b418e4578524ca37d47122c3870cc

SHA256
a771f91a68e63504213ae1018e94d0fcbb2f02692037d446129191d1cb71021c

SHA512
09f77da1ada4f6a942bfd7edd1d06587a75041478bcd80e167e1b18f31a75cf8c17ab418f9fef8e5f2794602e62f1d0a20c8bbae92096123ba08575d6c6f1009

Download Submit