a3be7da80839d34bf469cb5d29bf1c7ea81aee33dc887391947b6b6babea404d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

110fb18f1d2e1bfb304d2f754b2fb4db_JaffaCakes118.html
Size

67KB
MD5

110fb18f1d2e1bfb304d2f754b2fb4db
SHA1

005f06c2a99348c558fdee3b415bd8a360149863
SHA256

a3be7da80839d34bf469cb5d29bf1c7ea81aee33dc887391947b6b6babea404d
SHA512

a5a7e538cf3419e72b6ca8fcb3c0e06a0d8b2c7e28011a036ba50f9d8beb21903de9b37b95f11af4cb198aeb02fc375aa43939f291f18723b0ebf0c7dc0bce2c
SSDEEP

1536:IFGIpBbqWPy2rAw+O/kKKQiAlmq2rAt8bH:IFGIpBbqEy2rAw1/krQh8q2rAt8bH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3680	msedge.exe
3680	msedge.exe
4296	identity_helper.exe
4296	identity_helper.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 2968	3680	msedge.exe	84
PID 3680 wrote to memory of 2968	3680	msedge.exe	84
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3564	3680	msedge.exe	85
PID 3680 wrote to memory of 3000	3680	msedge.exe	86
PID 3680 wrote to memory of 3000	3680	msedge.exe	86
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87
PID 3680 wrote to memory of 4164	3680	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\110fb18f1d2e1bfb304d2f754b2fb4db_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa647046f8,0x7ffa64704708,0x7ffa64704718
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15054844355773506710,3036366875968077886,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a3f32e54f8558df0dc76822132d4f7b1

SHA1
e4273c1b37ebc6b7851277fa4bf7193cb15f5eca

SHA256
1fd86fa2c1f4695dc0ea43aab3627da1791be458bb502828f2127870608ecc03

SHA512
39ab05e6f3ec824fcae01307e63b545735c6e0be4fa67f200aca867c7e328414a15972b6c94d5f618db94996abf03466553c2535ad06c64d5ef237923f8fe9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
40939945edf2be40b5a9de72ad046c51

SHA1
77635b02e00432b281273492de3ace15722c5035

SHA256
0e19b6084bd43c9d3d2ee951d9686e7cd389847856332423f116c628a3823e90

SHA512
d42d4fefdec9ab06961752656a3339f6b4922f24e89d55ea82a9c217be7ae519fb363468ad2d27befa4c4879b1c2c2425dad20980a54caab105bb710d350e923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8c50be9624019115dc207050650c4eec

SHA1
163a6b7e5e592d0a88f608a9d75e9b0797c4864a

SHA256
d7a67aef71f39e0d1d52d98c81942c5ffbe08e3949621f76564d86cb7fcb922a

SHA512
df7d04d59ed6be2317fee59a3dc39b721afb86eb81c8e64120bdbc17de7a8b3a4cac2a597511fe2152595fb50bba4e19c0e06b606b1dc1536149368641888419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb6499d15e3881497289ba5bc114a6b2

SHA1
3cf57dea8b71a6bb175c8ef206f4ec1a4d7119f6

SHA256
3709c40fa9f72cd6c06ba1572b7ea46e81002fda4a6200e9feb870992a1375b0

SHA512
548e135d6a1bc4e66d054efa2b0ec51e147b2d0c67a7511843acebf0ac68497b11795fd9f98ed91632068bd4035e7c0119d657ba0599571c1563cfc915999d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a32b6c285b0f100f175822159413e0b5

SHA1
00cf4f2381e786c3ca019de5721fd5cb7e303901

SHA256
a78b6332976fb666e8fb8af46d170b3ddf06f5868f2e01907b477f4011c0ea0f

SHA512
8b64093a93f07e5cd210e66e7586bfc36c13f67f281435d2628630ac591d2a306a333ee26f10796feabc55000f0966cd2558efee9a264b383604a6be0ba2b1e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4375cfe29df12001581bdfdced17e67b

SHA1
8d7cfbc37ce2610be2c9b2d904cc1db9b420f0af

SHA256
46a91eab45b2e13e647cd18dfd793f4b028e700bb29f5d70a9f4f3d6e989d544

SHA512
7d2a234a91dadbe489491e55d848852288cb3ad67ac64304788096a28b962c6c8ec217015f65a201bef1c214f2a2f357874dc7fa2ed7ed43bc26861acfc30a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7b650301277b35332fafc38ebfa63503

SHA1
596d25d288d81173b0161a73e75a6ac921c82dd5

SHA256
c3f048a921343be51c1ef00e8c2dbb8a7cf15aef9341d52b9636f62f23681fc2

SHA512
3c93b95155e9fbda87e49f59410dd2a3ba80242872220a67814264e906d895c326dc9f740a0b56b97cacc82b48046225de5c5f53759ec02ef998658e8ab8582e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc62be1d43c6819c7d1cd4324d12de9d

SHA1
9b75dd0a50965cc00d22064d492bce0b2e4a0258

SHA256
c01d4e3e843324429e02f4cd47c9d10c4991e4db3e10ca4709aed33d123426c4

SHA512
091c7cd3e94cdf93043347be9e12943280f0d7d936cbcd7f5358095b91c87c32f495fe93a3cfc671288fef619e2a09fb04acfa48d4d45f967baa7de2abb89f9e

Download Submit