2c08479d11556df94b8b6058d77d53500f169858cf5832e8bf2e512af8dab858

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1673528f2e1fc65113c2dceef58d6e73_JaffaCakes118.html
Size

35KB
MD5

1673528f2e1fc65113c2dceef58d6e73
SHA1

ccfbde49226fec3a8e493d6491d8034036d696c4
SHA256

2c08479d11556df94b8b6058d77d53500f169858cf5832e8bf2e512af8dab858
SHA512

9365c0fda7d0f62237a00cd85e74c53b0fc0d48b048e67410761685738cd7b5506dac92bbe9f3b6935e93b4af7dafa103ae53d8caef4503d5946f6587e6fd297
SSDEEP

768:SOUOqUDifxvS1TPG3TWL59oBxrAkSBhRlyoamEzoRNEBvU5w:ShOqUDifxvS1Te3TWL59oBJAkSBrlNah

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
2656	msedge.exe
2656	msedge.exe
876	identity_helper.exe
876	identity_helper.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4516	2656	msedge.exe	84
PID 2656 wrote to memory of 4516	2656	msedge.exe	84
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 1704	2656	msedge.exe	85
PID 2656 wrote to memory of 3956	2656	msedge.exe	86
PID 2656 wrote to memory of 3956	2656	msedge.exe	86
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87
PID 2656 wrote to memory of 2908	2656	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1673528f2e1fc65113c2dceef58d6e73_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae46b46f8,0x7ffae46b4708,0x7ffae46b4718
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,8402442745009758449,15805651130875446510,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
32KB

MD5
eda13c6b6a5166489f77c8d20050d7eb

SHA1
83d1706bc1bb4b7e491045b945c3b50db09f58dd

SHA256
6031816aca7ea5570e205613e1d9ca27f99dafad04dfaa478b78b7127acbb637

SHA512
b8cf001a29d1c1a1d9d075e7e695cd913d946ab657b77ef1e23bcb452cf301f7c6a7d7c6da921e49b56108e7794ec974ce44c0fe058180aa5c9e7771f2906357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\31c987606d7d2f89_0

Filesize
204B

MD5
399ea8c9a59b307d462e82b364fde47a

SHA1
56c5ea0f6163db0e1f73388f914ab87cb29304bb

SHA256
045bc4ca2c4efffec4b2b483e5d6d9713b6770566fe2b3655e8110701ff5d83d

SHA512
6824164623b7369a7ab5957ed674a3ac2fb7b778a281806e468244a4dfb844f2d294a06de503a28f4c20edb47f5313ff60ee91e733f5195d1d47a3fee26a7359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
9558d27fd8326d4b1c7063a0f29c0103

SHA1
b70c20721eab92bd748316a954c3f40f01f2047b

SHA256
251db55200161d447ebf4cce50edd2eac6e6274bfa585474abb9da5e75c11b40

SHA512
d0b8547e2dc7831b4504587a49598b77426facb0912f3559847c82489033bec6e8bfac70da305f7d808090e65de04b688ea0b7fd7a5a8f6d76c1e457b560badd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d08d8060d72449246b240954a3387c83

SHA1
204bbc6e04e94e50e2ab2af3bfafcb814c646eae

SHA256
c4df2b4f9faa0b4938ec96b16d02f4d0e644407dbf268d386ba4cd4fed459bf3

SHA512
143dcc5d855171015b4d69b8cf3d68fb328cd92bad9243a14688359fc28f06fe89dc12e165e5105b54cd8063ecac734440a71017195e7381604cfdc6ade8a244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
03a44620d8135f61955c4d86ecdc4196

SHA1
b535fb20090c105e52e6b9a2a9d8cd2d783f4e40

SHA256
e50bbe4d45b6159ed5a55e4701eaa103bb355ea1f8a06c8c6d454b22f0b9a3cd

SHA512
bd153c3bff3955bef947b83cb95b48edeab62b2f596d0956a791510631df3f3adb87999a85062959068b4dd0c4c99c1512278235f93ae06c296e39fac10860f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12024ee8d4c068551e62c5b44dd36d8a

SHA1
679e5ce8e4a55e025f132776fb2c1fdcb40d418b

SHA256
009b090e418318429870b2adf3c699003fd33d199bc700677789a549c354862e

SHA512
0ad850352f043fcf054e22a159eb5045b6b14fd524022d2a1147966a7c0c95498fc28beb05df96d49bec417e79288ad26f91653ad9f35040370b7923ea640208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e7ae26e9dc8c4157955f331ca9f901f

SHA1
ab5b52a6c614055389c3755ad8b8432c6a49c35d

SHA256
182c76484a1014e8b900b51fcd3112fb534a2180ce8d3d41923b79bc458217e4

SHA512
4c6caa2525f969557c370b1a3238a9c3b0bfe078f5385addbcd53d4cbd00ce40c9a7943c94f0f1ca58fa86b5bb04c224ef9d9bdd62abaea80f8f63bc9270723b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59cff2308b2d0c71fa5e193a9dd0ca15

SHA1
ed4ada5fc98e6ae68306855cff06dd43bdc1fa5f

SHA256
b16f0ecfc9f6e688343b83ab9589eaa035464e8669f4cf598ce5a8e1d295baad

SHA512
3ac206c6e42410b13c987ea9d74323d823dc046ff751e6e6ae75fc35c908241a590281fb289400ad4bd3f152e2547ed5e14733eda32c8a87318c7ca7579d1774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e203dd107b38ddb1c3f0a68902825cd6

SHA1
9ff4c805098dd1333d79ece2ea1394a80037acfc

SHA256
fd902e47ed7d7b40ad5cf64de05f7d1daa39db7b3c317f4a21f60a8d510b07b3

SHA512
80f1959e84b636914a092e9d77790a72fd76540346c7df1758e42deeb1b820e09f0cdad2a7c31e764ed91ba0dab52bcd8b9e2622bbcc689945edd4a9ef177d0c

Download Submit