eeca41ddc2f717c668021521dd2a683d0d3fce9c1d48986f47dbda161f1a5cdc

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2720c14f3e5229913b07ee0eddeb79d2_JaffaCakes118.html
Size

175KB
MD5

2720c14f3e5229913b07ee0eddeb79d2
SHA1

a476d82784bbf1576a144fb2e2a8f8d86d5c3d39
SHA256

eeca41ddc2f717c668021521dd2a683d0d3fce9c1d48986f47dbda161f1a5cdc
SHA512

abd560bea72a9f684d7e8d41ee3f32e137123a34d6bb67c1dbe4b1ceef0e911222b9f72b54ba5fce1d55accf5dfc44796644f3023688d1e89257a236d18a7224
SSDEEP

1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS3uGNkFyYfBCJis2+aeTH+WK/Lf1/hmnVSV:SBoT3u/FDBCJikm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
1800	msedge.exe
1800	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1264	1800	msedge.exe	81
PID 1800 wrote to memory of 1264	1800	msedge.exe	81
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 736	1800	msedge.exe	83
PID 1800 wrote to memory of 5020	1800	msedge.exe	84
PID 1800 wrote to memory of 5020	1800	msedge.exe	84
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85
PID 1800 wrote to memory of 1804	1800	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2720c14f3e5229913b07ee0eddeb79d2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8037c46f8,0x7ff8037c4708,0x7ff8037c4718
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,6208859036527231420,12886053385379077706,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
46KB

MD5
ac83857f0497a4a0e7669329827cf228

SHA1
18ea483c966969e43a654fcadea9719a8aca370c

SHA256
43337a1354f376890cdb73f3dbaf95a8027761c574c30cdecb321096be485d3e

SHA512
6a35c50764d31d4bac07ddbec2329238cd04f2c58c00629e523ae7fc2a7d6be5d1226f8fb6c3c1043b215c38c47951a66fa8a9d4f4d6ddce7664bd1d011db2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
9c858b140e4d1665a006c8a912ee9f2b

SHA1
5cd8ceb07b8849b04936f46f8e7772e9335cdd98

SHA256
353106208e115bdfdfe904900b71614eda613cd0244a4df027d0ad979197cfd3

SHA512
bebd2687a47e45e5a4da5c30cbad5b2a07c7a01ca631649a9e1ef71ce5318b0b1274b534cdf3a1a61acaa0c63c26ad51bcdd7abed1f03fe9c966cbbb8d05d494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
23605227ded50fee9fa65c367b27b186

SHA1
1bbad555acc9e853857e2347bfb9421e0af26626

SHA256
71f14bcc8e284053094ef2332787c6709d9ef3687d89a7ca159660719986c015

SHA512
c4597743e6525c50ee2b74ce7e46179e23c235a995a118e5225f3efdeabf39a823454e5d34d062423b3f9615a9520cdc451dc94752cff25e8e8b1ce888c4d1e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
66fadd0c0e5e2d5997fd1884f26d8f80

SHA1
564fcbf94427db5baa3ade16262c537f9cd93cb1

SHA256
2ec9e67a68a5b850ff7516cc8cbd1f3f57bad1687be75556d48b3b8725185801

SHA512
e47f921662ef218c94fcd3870706cb04bcb8887ea8ca88ee5929880818092962ca25d583191d2bb8c26c3c62b7d5070d9ba289e1a7edc2bbfb53c73b8c83aab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f440b9cc9e8e34b00b8b8ccd5d03312

SHA1
65288616f3cf11e4f4d5a4e4727513bf576a07a5

SHA256
264cc5b2c94f8d9eb2fdcd4349e8a92d0468ab7830bbbabf06cabcbdda3a114a

SHA512
fc6758593131840c6a089034bcbd44f69b80260eeccf013023484c51c855dfe99469e6cbc91eea69329f45a27d503606610adf1fee8a813cf36cc19f0131e157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
48b64e1fe3d54f0227676d586768a739

SHA1
77062ebc29b643944eb22dbf1199839ebfa5dfee

SHA256
85f3aba67c9acfbae1bc4097edaa7f7cfa50589a63f4e1d28949338bfea6d7a7

SHA512
bd70064afd8c8f500a77f9de2e3892e245077abef184c2655e96ab3bf5000d8e3e5952ea985df5cdcc1c0ab9f9ef9610d07929f9d25b563d46e4656fd98f737b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b27ced1349244add5590880bb488c757

SHA1
343c856118c10b9d9b7027b8e0f1be90021147cf

SHA256
559456ef37f02cbd0ef121b81f31ed31b04bd0d920e8107a0a13b5089e07851a

SHA512
c17191ad2b098129eb6c435fed0e928cdea08d822732802705f18e69e6a44bea7f4f1be0a5316135f46068f910f679e52c06f76db8faa7bc18438d3a3eba6c58

Download Submit