ae2f995ec5573a53eec73541a198bedbba873ca94d756c6e14c686e11d4ebf11

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20508986d5bb273843da43a61d94f8bf_JaffaCakes118.html
Size

120KB
MD5

20508986d5bb273843da43a61d94f8bf
SHA1

4ebe96e0f9f57b3d8790bc993abe9c42c0ee4d98
SHA256

ae2f995ec5573a53eec73541a198bedbba873ca94d756c6e14c686e11d4ebf11
SHA512

a034088f2e3027ef7f81acbe08ae5b27887eb06cd433e000578ff93438db5db514af90eb9698567c815abcf6a274043e6089d01d318fa83ee44b895f197248ec
SSDEEP

1536:NgYCWsKSNF9NU68kg5ffrOffl7aA9dnUqAonaU6COn8PHGTeldxgd:uYCz1NU6ng5SffpWXEHvW8PHGTeldKd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1080	msedge.exe
1080	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2188	1080	msedge.exe	84
PID 1080 wrote to memory of 2188	1080	msedge.exe	84
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 2968	1080	msedge.exe	85
PID 1080 wrote to memory of 1268	1080	msedge.exe	86
PID 1080 wrote to memory of 1268	1080	msedge.exe	86
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87
PID 1080 wrote to memory of 4544	1080	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\20508986d5bb273843da43a61d94f8bf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0d9a46f8,0x7ffb0d9a4708,0x7ffb0d9a4718
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6946120994393342577,12307751177085556507,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c80a691eae192d1b5e921e12d7d43685

SHA1
87d752d322f367d91b13686a8c41433ac3caa1f4

SHA256
878e3f741dd7be726edef0d4d1af834e9d932d64594f8e126c31fd4e6ab31149

SHA512
f669c2b1df02e1e8704067c853989083a1c107036b916bac0790015014da0d6468455200c46bd1414789e7eafd6cda6850c115bdd3f78644723be9fefd7934f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c23176e131b5495971d37775cd82a83e

SHA1
a8e66573ae49d09774c97c427d4f31bc6d6c6688

SHA256
a46101856344e948ebabededcc3edcf733a8f82a9746292e12470c01d3c250c9

SHA512
1fe290ded6dc7bc31b2e658a53c322b282c163efea294c5e50af7d1e2660a757c010c2f4dc2a42b38830473b83878fe43d4e36d8e9cf49db24e804b5de9025cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
81ecfeb3370046a9fd9fec129a2971a9

SHA1
ac2031c0e521bc19ce924ed621cfba5cc0c8301e

SHA256
c9dd7768ef3ce68c0817eb1317b12e9e361073622453f2be2598df7a83aa369f

SHA512
3b490fba87a0aaa5b0c9581af43b484102468ca37f7549015c9bbd47f7afc98207722e92a02c5eba765dfab9d34fef6c5778d8df08b891be87134c2497b7b290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a5318e617e45c0eb0fddefd7ed82202

SHA1
7bfd3ba393977b8707b74511d7b8e38fc04f3c71

SHA256
4ab9f43724c6633043d5406b9f9b45e03471e821afcaf7f2f9098b9b68fc302e

SHA512
4dfbbdeac12070672a76983ec71acebe4a286d1156bc19bb7bccce72bb1252caa43ac8496eb0ef25210085de1a954db81e43cb7de6bc914d1706ac09cfa38fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1dcf687f84272d541ef65ef8c2de24d3

SHA1
0223ada989a685cc1f1566a05745f8768bc21d42

SHA256
3705227bf01bdae6c75098d911762a670eb2193a158c94ac6ee0d2675a750fb5

SHA512
59c4366f2068ac7c24709f180616c04021f5983145a1c692f3049a2be201d63eb3cbc19444bfbedf1f8bfa6f40e2622952c599b93b39fcfd7d041738d1749eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02b4c08efcc00c4ea788899c9ee92685

SHA1
ea5c6e3e296e82526f0e99cc82f1048ab3a08b81

SHA256
3de1c67d1fba22ebb87325c31aaa2e06423b4d1267b73811167392efeb7cd9aa

SHA512
43cd50e85d995b38208039a19ba1a420315cbd6438d798b3d2553830c14f7d60b5fc72e0dc25a36c39b726985dce46384a8b7356dfe6f6f30f7848bbddf36616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e688687465c312771bbe4d416929a71

SHA1
ba2b1167033c7e2adec236f3141c661298befcbb

SHA256
3a47e170f6de1af4618a8b13b1c7328f57f453bdce6079c7462c45a8d0a67bf1

SHA512
c9df4c0d97417c0539668f06ef2d05b63b6af1aadd9f94b8daa4e949ddd57fcd583b74ea54d0e098acfa6d79971f4fe515f035ded392d43fa64404adfdbe7308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a94338dd1e76aa2bb9c6dfaff81fe8e5

SHA1
5e59c4913f8d747463404cdc0e0e2d868f79efbf

SHA256
609033fd83e60a6a3aa0cdb162276360b6851eb258c8ad6f8fcd1e9604247e85

SHA512
1730c07db6d31b893c0ac235f9e8677f1b28c7796c125369f57cb8a11723531f0d6f5b990f7a014942d47cf6ed2636e652fbfd828c6391098fe84e7542cfb073

Download Submit