892e680c818e5d70b53cab5aab82c1ed11b4363b76a5014d06bf8c06609fb9ed

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ec2ced255cc34ec47620d6faadb3b30_JaffaCakes118.html
Size

57KB
MD5

2ec2ced255cc34ec47620d6faadb3b30
SHA1

613bbfd6102cd635e1ea24fa4688eab8b5720cbd
SHA256

892e680c818e5d70b53cab5aab82c1ed11b4363b76a5014d06bf8c06609fb9ed
SHA512

b36e540b22129ca9bf1ef35c8dc5b0532b59f8986d65bd3fd9aea7f12e4f239619eb14eaecefeefc6f0f4dbb57bd0ca77fb3a834edab9c0ee6fefe377dc828d9
SSDEEP

768:wUmrUoggd9y0mLORWu1OKZtOS4aba5jBjrtSD+bk:wUfHgW0oOkIOStOSQBjrtI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
208	msedge.exe
208	msedge.exe
2736	identity_helper.exe
2736	identity_helper.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 116	208	msedge.exe	83
PID 208 wrote to memory of 116	208	msedge.exe	83
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4624	208	msedge.exe	84
PID 208 wrote to memory of 4752	208	msedge.exe	85
PID 208 wrote to memory of 4752	208	msedge.exe	85
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86
PID 208 wrote to memory of 2656	208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2ec2ced255cc34ec47620d6faadb3b30_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd077646f8,0x7ffd07764708,0x7ffd07764718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,13149432961571239431,498651438259038030,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95f8616e-54b9-4054-accc-5e8b1865fa44.tmp

Filesize
6KB

MD5
4f119a22be9f57deb12fafced2b25174

SHA1
2fa9538c09e2b03834439f594bbcedfe8926056f

SHA256
a89c86e1624f82d024119ddda9bd4480eb7ace104417cd938a469a177e355fef

SHA512
4fcdc4d3d6c4ac934b81c547b941bcb90f84fbcbd6447e725ca7bef4722df0653b1df41ee00222d8a45f7c94ee36104b6f4bf3c7693dfd853fd5762fbca98756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
705d2d6fa3c8f19e54c219c96b742ea0

SHA1
fa374b624d06468f3741d4811b58d28d702def3f

SHA256
42b643f46420369cd0783bf7bfe34c6512cd3e73345fad01f91f72fe9aa418ee

SHA512
bffc11fa59ea65cbb2c42e4f4880ef19b0f58a26a2428b96d439b60821a0c87a22534cd817d5020ae337bdf628dc36894ae7b5274f2a3ddd23a4892618775bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
91c97516c55e683f75083e5ee99dfc77

SHA1
a37d11908462d2320811b749ed36547424a24cc2

SHA256
093bd22493398df1a9d95432412cfc0bcc4c6edb8830f36233d2a8b0bd3947c4

SHA512
97a2e493df45d8cd2bcc10b22a905a729c84ef5b5d0651debdab0d89d8a1ac46dcc592198f7d5fe8676072d3cee9b170cfd1ef0ee842dd651e679a57eddd1c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b2e05fc708c286a6a295b008e768eb0e

SHA1
cb4f762ed5825a611d9ad0454aecccfe2a00592b

SHA256
c70adf0d67276a8cba77db646c034e62ab648b5df2dd7907fc972df06cbc884b

SHA512
1938358b0639bfb9707d8a535c04cd9287ae97aa451e43c7ca2a6b283cd0ebc0736ad500945910e1ab10eb17fe0f232c2c487cd6979e684d87088efe679fae6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8ae9860511a0b53e7799ebd4a80511e5

SHA1
dc8517c4de0aa375c54d98da945e55f0206d9e6b

SHA256
13df222e26be0fb178593a9dbc2316b12e861f5a2a3387fe9a5fbd5db1763774

SHA512
db7a642c434eecfb04118d42ecf0f3b7f7c2a7f23cb0e6c430666f404d096e8240f78cc61c441e467ebf9fc1e751cb28cd70508c5a00a42957ced7b02d0d98e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
501a869158e8258bf7e2a6b6c4c18a8f

SHA1
f9c80cc2ecc62477aa9c2023b33872fad0bf3fce

SHA256
551735af4ac6a7a824cc03ecbc4046c3cf673a683bc50a74c5d87fdc7326c374

SHA512
19ada99f5c427bafa80255f8df30c418f3212c02bfe8dcdc584360b5a3eed1b1a4ad55d218c738adffb5967621459142108c9018a6add558814ee404030fa074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7338143a7c061063633c32f223bc3a6

SHA1
71ec0c536f52ae07e87ed87d93758c57a0969685

SHA256
63e218ebefd78ad013ae613799ebdfc950f8589ec4e51fb4a05887f39a1accf4

SHA512
62ec02c9986c361d47e42df25a605acc34b64692fe33a5f7f9109f214d9861a8dca8924b8c858da89187f1689141287ba5b45838e1e3899841f10687302d3bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f28b6b9b49368af9bfb1bba6fbe2fd9d

SHA1
9c912686825d38c3781d951696643770895a9bcf

SHA256
fb618e7c5f7eecc6adac7a97fe2b8f3e61565e281e48bb14278ac8f1fec2dc8b

SHA512
b006cfa792953f287b13672ec199b806038d8669b918798a498f2b38bc9901070d59034760ac807f00009d266f1fa488cea8b65ee44847d5934153051937142e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
786e24b54071c7b232199d4e277e6845

SHA1
02bbda2078065018a46b0224ed5fbe8487f910c2

SHA256
1e7c78c335fde4e9cca7427248243c09643c0f74ae305ce785a06a2dde278f54

SHA512
8d4a8be2c5031743f241994550ebe481aa777e82713e395f04d12efceb6d2bee03d25a7172ae025ab92f469bd6f2f74913f2625636925eb7a927055377a71c1b

Download Submit