95ff9c0ae5b53cabd4c0722efa2356af2be2c08bb2ec6f8b964f0e57ea0c1bf6

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eac17f3d58dfc2bbccc85c74f90ebad_JaffaCakes118.html
Size

175KB
MD5

1eac17f3d58dfc2bbccc85c74f90ebad
SHA1

6fe255d7143c258ebc94033a646e5e52441b0f8e
SHA256

95ff9c0ae5b53cabd4c0722efa2356af2be2c08bb2ec6f8b964f0e57ea0c1bf6
SHA512

c7cb19b08da3c44b18471343ccc4613dbacf1e01f92bbfa8ea43038ce015db47ab21c98b08c18f6e907b69a8404d64c1af8baf8b5a7a3986b9b270e91c773e32
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3WGNkF5YfBCJisQ+aeTH+WK/Lf1/hmnVSV:SOoT3W/FcBCJi2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
4328	msedge.exe
4328	msedge.exe
544	identity_helper.exe
544	identity_helper.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 232	4328	msedge.exe	83
PID 4328 wrote to memory of 232	4328	msedge.exe	83
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 3436	4328	msedge.exe	84
PID 4328 wrote to memory of 2160	4328	msedge.exe	85
PID 4328 wrote to memory of 2160	4328	msedge.exe	85
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86
PID 4328 wrote to memory of 4368	4328	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1eac17f3d58dfc2bbccc85c74f90ebad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8dd846f8,0x7fff8dd84708,0x7fff8dd84718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12968592790572016681,6069035833250449139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87acd7ba-b67c-44c9-9a75-90aeb63a9417.tmp

Filesize
11KB

MD5
77ddd614723d9a27d12419c1e567e1d3

SHA1
cb4fa208d4af2c890c78db6b6a8a82701d28a55c

SHA256
b6b5ee06bcc3931151dc062fabd6a30fe039a38f508b72cd08e9a324b588052d

SHA512
54f0883095b00c2773a3ddd3a83a78ceabb470f2ab1f9229418d97f6117f9839670e46befd55d143988031ee83a21a30b9308bccbcd0f9c9eb317e9c69306305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
46KB

MD5
ac83857f0497a4a0e7669329827cf228

SHA1
18ea483c966969e43a654fcadea9719a8aca370c

SHA256
43337a1354f376890cdb73f3dbaf95a8027761c574c30cdecb321096be485d3e

SHA512
6a35c50764d31d4bac07ddbec2329238cd04f2c58c00629e523ae7fc2a7d6be5d1226f8fb6c3c1043b215c38c47951a66fa8a9d4f4d6ddce7664bd1d011db2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
b2335d07708cabb3b9745a47cfc872dd

SHA1
7c6e2eccfe5b37ac21af41620d7975b663cc7099

SHA256
ef8364aea1b0302809d9d49842b78200a9de079609f8cce7a3e81c3be1e6ca7e

SHA512
039310cebf1cdaeef649fa53252b1e97b80f42eea3546e4dd77d0828fabd12fc99ef630e46e0b19a90853b99a9ec45fba0c4d480df11cd2e6473bc85f11f7d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
373f902abffc928235f9837dd0536948

SHA1
837f550991e1897c349b0a96aa2e5714092b81e1

SHA256
67ef824b5675f7aabd7ce0f26a65577d5ed9c5c7d1ae66a6a9ddeeff0d7fd780

SHA512
d11aba05871161eee8fd84f94e90dd3a7f3cbb59e7d1d83eeb13380bccf72230204a047b0e0358b55b77c6c7a200e8dce1b4780dee61f392b143e9073500acb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7473cac3536843bb471abcc89cee7a13

SHA1
83e3854994c540989301ca2b7fa30938817f3faf

SHA256
79ef8f0eb31bfb5f3acd4426319bcd379524cdd3cdf3882a3e8efb10be0af622

SHA512
52bcc72dd351a51ee3f4aa682fd7ce25cccd14a8b8a5a42d00484d55ce78836d2f87569eba6398f14e54ff2ce80490bb13dd7554b9a2c3397dd6142c48a3eb74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f4793642d06110fe33ed2879fd0867ea

SHA1
9996c50ee23372a42222aa922ed2141de1471b64

SHA256
3ef0cb2b22660dc5dfe4f48e26be639947ec741c590ae4e600ec8ca790a0f5eb

SHA512
49c750a081499c2991e547de08f70da3188147857837d49643dd50448f524874edb9d06473f6aaa74de361e944d0e345a7385b768782b9e07957c5f3f7b741e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bce1eb472d7268c61c683442258d44e2

SHA1
3fc0fd6282df5b0e4858fd6d485bddb3cf8a275f

SHA256
631efe4a9ccae0e461202fe3bc349aef1b503f5a76d748bee8282e80df139acf

SHA512
16a0cfa5c05f7402bd03fc792ee1bc68c9e8e0938fb0328bc1519681654ced62c859957672a6713e908909021f29e830ca4676ee3cef2c4e7e99f3e2543be825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit