e880d5d9f978a5e039e735843491b4085c0c3d9f8a55053f919991763c93d837

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3def1429a94906a83e9ae1e84c41f20c_JaffaCakes118.html
Size

39KB
MD5

3def1429a94906a83e9ae1e84c41f20c
SHA1

78aa56affbf12dcab1123e554cb843af8d7caea9
SHA256

e880d5d9f978a5e039e735843491b4085c0c3d9f8a55053f919991763c93d837
SHA512

08e03a2674808a0ca38074de34b1d0f04212ecbdabd7e779105f76af27b1bd5ea2b226770c2336ecfad40090d082048a9003e1fdf10893b113a0f1d7a7e6a55b
SSDEEP

768:u4DyHHFPkzGUq1kpJoA5kYTWK+XBpkVRr8bIU9do2uh:6HHCzGUq1AeKkYZBKIU9d4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
220	msedge.exe
220	msedge.exe
3860	identity_helper.exe
3860	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 604	220	msedge.exe	82
PID 220 wrote to memory of 604	220	msedge.exe	82
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 3484	220	msedge.exe	84
PID 220 wrote to memory of 380	220	msedge.exe	85
PID 220 wrote to memory of 380	220	msedge.exe	85
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86
PID 220 wrote to memory of 1404	220	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3def1429a94906a83e9ae1e84c41f20c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9272c46f8,0x7ff9272c4708,0x7ff9272c4718
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7360771091189858914,16556733780431650100,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bf3a18a-2ca2-42e1-9b25-e24100f9256c.tmp

Filesize
1KB

MD5
064471c3acad6fac06259de6c9930321

SHA1
70a99f5f838d1c860e337f25d017ff6708e985e8

SHA256
42466cadcee5482131244e977bbdc44af2333918b70b6baa1f0b11a04bb42779

SHA512
e964abb7f659e0c58373468fec5ce1bd68f6755d0cc54d7e65a49ddc064ede4005678da9fd6f8f88674bdb12228b553cfbf99852049bb716ad5fde5281621b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2414f096a4ade493551a247ea75e0164

SHA1
42459080119edbea14272877e8b88fc9d0078499

SHA256
a883471430893dc034a21ad69cbc969b8b53a80805f650222c83251ce4e65c58

SHA512
8e62abc48eb1596097f3fa65525a41dcefa7b95a66abc84ad71d23858d2d2157745e8769e934a17c8347387c08a2b0cc25e3ccf4360d02088dab1e5dd020827e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4a89c9db9216a4747e36a7e85b2da4b6

SHA1
7797b69ee5f5628062d410b4e231e8b341db8ae4

SHA256
88062bbdec8bd5469921a67d92f5406c90435509c4f3eadc8b471d21d89699c2

SHA512
a205392b3dd1c1c35a6cb12e7db298f442a7cd0363a564e54efe0e2fda1ca0e2cd94e8589e540cbe1a15993dd267f4cf87961a7065eef32fbcf98fddc1559e15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7b586820f1bad68f141934b7128764fa

SHA1
85b00dce2de9449b0644358613acc5e59b7571d4

SHA256
018abc68037dc4563058f509e267ac8015bcd1daea5019ece0be07986ba8a300

SHA512
8201d0822b8850f1dd4f55753a7982d5d6df7ee9f61da86559ee7207ed893958905d3d6e42be9cb0455e4985624d7461f424be26a5bda3c25f2687f754a070c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b9e540fa00e7410abeb9416f6e1b051

SHA1
69156c206bad68336dbb922fe5914bffe3dacd54

SHA256
7ead35ed06a8b52b259d6a8d739e1738f2646dfd872ee85e3799f55b522eb7ea

SHA512
fc0c9c52623f080c25fcadac8e56acd98be8772e0d7aeeb18c67f0c8ce01d7a1fe083970f0f93b6cce4b906a6876d92cefe40dbdfa67061f7bb3a6af0c99f3fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
33d1b85efdef238ee473eb2785a12a0c

SHA1
c8c92ec58e9627fffcc43e25a03ef92d80715b68

SHA256
3482d1100252b3e0c50372709f7e48d6a1f6a4fbf4c1fb4c0bd9cb97f0fd5b90

SHA512
b4670ab30aadba0f1a249842813b91a922d178f6d1815dd7d4f262f046ba88c68554a857be50a3e490f889d750d6d0f49e28a17b94695741cbf4c463feaf1f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2ad9fdc9daff5d1018579dfa8e0cee7d

SHA1
e0997e7b7ec0b60c58a8ca0ce8ef86d3e0658464

SHA256
a516bbd0e232614067c92ba74150752d83e66ce782d52d491c549b11ec61b9d0

SHA512
bd353fe0e9497384e80718415578f48f293fd8609b88bf671b3347231df597e1cd6beab4009c8b77e06a7e28c06652f2ed14388ca609d947c600aadb545f0b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5a84568e2f15d47253a22807c08018fb

SHA1
24365f2e57ca895b7815ee3e63c375199550b185

SHA256
fb4fa26abef260c49678491e4928310dbbc4ee39df0e0a3b178fa822f4d53e96

SHA512
123f73e22075af8e215d4cd000cd45382b2c5b02c1d6ae383f7e5a70662cbc005ef7ae80912f721603e4419571a098bdaebbdec0d5a68aceb958ec01aa5fc6e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dcba6419c2d06f27ffaea0128801f388

SHA1
b4dab915fdcb0b22498ad8f3e651f0178e45c1a2

SHA256
b8eb90caa6931a31b3f5fea1c0a1db4c0ad8f8713cc82292861948bcb47f5816

SHA512
af5d56c6b72c0db5d933bb4d2f1c6a1b4489c2c0a03e620c50475ef870ae53e7b86c085ee1fa56507527396d6a2bce9e6e8997e16a73b38ea82aa115bf680e8a

Download Submit