82e25c623ab2d9c8179e49869a65c2136cfbc674a08312d040ee54e059f6406d

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb83243d3d2ae66838b39776b8b47cd_JaffaCakes118.html
Size

175KB
MD5

3bb83243d3d2ae66838b39776b8b47cd
SHA1

256b6a4859d86d601f3260210b743e928f297c78
SHA256

82e25c623ab2d9c8179e49869a65c2136cfbc674a08312d040ee54e059f6406d
SHA512

ea1ae8e4a7d5d8a874808144a733a4227fe6c420528e93dd0697cb1923b3047aca529795cbb9aa2010c4c24f92e9fd3aef059ef8ac1866a425d71520e03e307f
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3CGNkF/YfBCJiZo+aeTH+WK/Lf1/hpnVSV:SHCT3C/FeBCJi/B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
3288	msedge.exe
3288	msedge.exe
3200	identity_helper.exe
3200	identity_helper.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3172	3288	msedge.exe	84
PID 3288 wrote to memory of 3172	3288	msedge.exe	84
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 4792	3288	msedge.exe	85
PID 3288 wrote to memory of 684	3288	msedge.exe	86
PID 3288 wrote to memory of 684	3288	msedge.exe	86
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87
PID 3288 wrote to memory of 2068	3288	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3bb83243d3d2ae66838b39776b8b47cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa797e46f8,0x7ffa797e4708,0x7ffa797e4718
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15617931417522737812,13474202391633572739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
33ace36731b0e377095dc6f494fd15c9

SHA1
9542d66e77bf773ae8bc1713e38bc2b0721d31a1

SHA256
cbba86d05907351485e227b90deebdb6e5049a864fc7a1fd92ba5b325a88d281

SHA512
ee806ff0805d0c1bed1246ccad97438032338cd0f6072e1d5db977a8ebdad84a6c12d2bafca001484ca3068ccd197d764d7a23d381af6fef0d554809b1b9c202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
79c2352c8bb8de5f543481c13ddc8c3a

SHA1
ea6263d820ea54b237f92bc67e91fb7151f25641

SHA256
3c40125e3d282eb8da355753667e13f2edf295795fd08684450b31e9c7218ab0

SHA512
644e59f4d60dc85d126c5a5660ce11336fe68f222396a604a53e6f4a254536a9e248bb080eda947c4dd16170c058bc4d56422404eaa5be72887b358aaffd3243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
db7689e7512b7570fac816c5eb7c45be

SHA1
a76ce690897ff078ed7334bba4d8fcf7b5ad2b21

SHA256
14bcc54317a90ace2a53330ddb994664826ac2ff54f14942f9633ba9233766e1

SHA512
aba7dfa0ae9802f537370e2dcbaacde7f5ea4e26efa392ccd771b153d5f430573f262cec51a2f56f4ee207986f1e14c0576ff961b8f21f53a529e4077a6e4bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a97b65a81cce72c71440849d9b2f3964

SHA1
5a9f1b18383c349b933d46170df821eae098df38

SHA256
0068183bafe5df578846e22b3299c8614dd6f9d22ffbf48e7d86303443954490

SHA512
2ac1e83c091962f5c6b2950524c98b9aead1fe8f842ac3bad1d1ed606b6ed0042e2cdc3211a1212143c565d6db691e344a1caa5a9cff7cd33f86fa2c05e06080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5a31245d9311e665dcd6f5f04d8c0f1

SHA1
8d7552391755dacaed0372156e90a6d96a6f8b78

SHA256
0435325aa8c4cba2e46ece89427e8499aca9c4718dc8c95d4639ab0383a73b2f

SHA512
1e79e1b7a00c595026f72d8c4088a3ca93c4d2640aca156d99e8cf830f8d64b341a1896589521bbf5d69ec5280b4129e7141bb3653693554637103782880f14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
850ad8b2b53004ffdab42070c95f16cf

SHA1
62908f38dcf129a6191c1b17c7e2b441f15d6acd

SHA256
610eee2d9c7edf7cee339591690fcda488f3c3c8b9963cf3f7743068de82cfb6

SHA512
41389107992b73405e38fe28f132b02557fdba7733e2f443cad24588a0e5d770a22c06a902cf4ac6b03eaa92b9a2428eb39fc609d2f367e9d7ee46ec05cbd7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e798647e32b34794c030580449a2b257

SHA1
b95fe407f7362cd088aef91a2c177d2675825917

SHA256
a1242dae8e07df4452d828e7e7abcc3ccc8b8056fdae5784af72444559ce54c7

SHA512
70745a7dad5a0d96fa35bd2b01c3ace4e044c8e076b9927c807a7bad8854252717a88f6f5400f3e442386f426aed5d60d325df16aa685e08b9c4571ab8b57c2a

Download Submit