eb46e13dbed8710b05a08c4a947f2b82d114e133b550e7c687fc1d93002bec64

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fb3e268c9333aac59df08d6cc022a5a_JaffaCakes118.html
Size

61KB
MD5

0fb3e268c9333aac59df08d6cc022a5a
SHA1

3d38e42083988aec35a5670ef957b7133b8c0e7e
SHA256

eb46e13dbed8710b05a08c4a947f2b82d114e133b550e7c687fc1d93002bec64
SHA512

2515e2d2e7aa46d765f2f95b80efbcc2b4500f5fe3e60266597ff884f4e5b49188aa1de5035492df7d54fe75c149ed26a6e84bbcefb131e2957c0ba95043a1b4
SSDEEP

1536:Su+srMtjImcDHqAta4DAzWMHXtW9SCUg5H8RKjOmfnylw6EOS5L5dsSso6v+cw0m:SbsrMth4HJFr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1860	msedge.exe
1860	msedge.exe
5052	identity_helper.exe
5052	identity_helper.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1032	1860	msedge.exe	85
PID 1860 wrote to memory of 1032	1860	msedge.exe	85
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1008	1860	msedge.exe	86
PID 1860 wrote to memory of 1108	1860	msedge.exe	87
PID 1860 wrote to memory of 1108	1860	msedge.exe	87
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88
PID 1860 wrote to memory of 4228	1860	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fb3e268c9333aac59df08d6cc022a5a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc18ff46f8,0x7ffc18ff4708,0x7ffc18ff4718
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11479060350158938222,1896883068325142953,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
72f56596f2c56f3444fb7ab63cb91afb

SHA1
43a4de224ef2b84e1454bee22de4047f00825c64

SHA256
ca599b9033d515d84206be337c8d74d17019e0d2d09bab08b548a935ed356db3

SHA512
0e5132cd482b4979cc52a637c393fe7c775af95bd59630c933eb2ede50e890f9a0d8287927ffc2423ac6ce3e1729c0235264c795f8e16dace0ad70cca925426e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
dfa7172b0f4b4bada5cdadffda705a5a

SHA1
fc7e5c46b14dc2ba7ec9df8fe01d5bd03e2f6ac0

SHA256
21005fdde4df3a5b1b95b6551a03203a4cfa94a694145b3f380e65de6b5c8f0c

SHA512
ca9c22e208d79d057cef9322cda7f9270fd3e20ca1ac34307ddb054a4bfdb447b8199d2fe9a8cd5cef3888707a27d970bc2f55b6844e526ea35330988d8531d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2b26c9cba3902d0cedb4726b64a09b1a

SHA1
1a869258cfc63fb3b9f3bcdc98142f508cef804e

SHA256
6dd431415f11d9ad8d1944c75933d097a297a4dc80d9c4cafe24b57bcc9ea1ff

SHA512
10811214583d41ef29e2c7117932c1fe6c3b42e34aa0dc5930571ff4c7ba049da9c734b009f699f59fe64d1e09b6ebd912c8ad5eb425cc8a65ce0473d2d81492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fbab00cd7a420aced04792c8a3035119

SHA1
733c895050f03bf94fc3bc52a19148f40c5004f1

SHA256
953cbece6bf504dd8262daafcb4ec99cb7456d93ec268d8650a274125f115e21

SHA512
ec80f04ab2a35b00af1d1916cf7d513fb3cdfd3c17d33292e42926271f6a3712fda575b07e05d69f98db93ded65416f2ec49aced1e7b2e54a8c52c8107593758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
53e5672fe35939965b409f1f6d865787

SHA1
b513754b9f31f3cf023faa4868da363b797d7295

SHA256
c619fc1ddeb52f7f4f1e07716c2ca3be486c4a52ef6566422f70342971c7b486

SHA512
dfa1ff8638e8f019c8a39d0e840490e4ee79d9da403e2dacc3d318caffb9c2a28e7c2621a482578399b2b8d230c51468365560663641ade1cbd081b6dd4a6ab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb7ab7c9b04ffb90bd3c1258b7dbb364

SHA1
58ad13b7a3dcea89c85ce548b51f66a3b41e5b01

SHA256
e8d23ba09816576df25d18abcf37f7c7306821763d5d14cf14f107bff800094c

SHA512
d06c9f38eb10764ab869cfd312328ee7e800906c058e5d6deb5972cb0a59d520a389d05bc29e8db8e536935002f1d2c384f4c498d598081eb13fc6b94799979b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
71ebea10fcb43e531d798e2830f3970f

SHA1
23c248b47baa15e266aee37b2924c2d31f9662c7

SHA256
2bbef09b0243e4bfcb67144104cd39563705590feb68f701e03381fed9eace37

SHA512
a53cc1ea781a89349f78e692218a2545ffb9379b2f1cf0ffb7a1f0609f8cd2fcd84abbed35c6a77ab6dc4dc12579152b13d42195e828d49b900678dfb0f2b661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e827ad933ebcb1fb0cead13631b116d

SHA1
e03d7f7d9085ef9d82c5b77e763a0e8dea36c518

SHA256
086288710aa12da5bcb98c9756638894b15ab8b3082c318e0e47067b2b709c44

SHA512
cd96885b822574db11eb59b7e42323cecaa650ed95f9b1e51da7fa91e3f284a76a8159e37982bcfd0a701b10816bcac8b8436890baa65e2b08f43b98add90ed8

Download Submit