8cc861d39987509cd6c6cbec64fcedc8c2167eec425358c3546b9bcf1ded3e9e

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fab68f1994e4531e907febdbbd4a17e_JaffaCakes118.html
Size

189KB
MD5

5fab68f1994e4531e907febdbbd4a17e
SHA1

7db33fa965333213faedd334dc324fdc16d58d65
SHA256

8cc861d39987509cd6c6cbec64fcedc8c2167eec425358c3546b9bcf1ded3e9e
SHA512

7a1aaeeaff0d57b0c65d12f656e94b3aa116d8b17dc96cc706b05d95769aadb00b8b5de54e36b107720e583e2bd34955097eaddf3a9ffb6a9e59fce1673369d9
SSDEEP

3072:FcgRWCZY9wIP3lFEBZNKDjEgORjlIlUlkOxYO42ZMalDCv5C+zMM7jHNBSNBLtNP:FcgRWCZY9wIP3l2BjKORjlIlUlVr42/F

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
5036	msedge.exe
5036	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4040	5036	msedge.exe	83
PID 5036 wrote to memory of 4040	5036	msedge.exe	83
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2852	5036	msedge.exe	84
PID 5036 wrote to memory of 2484	5036	msedge.exe	85
PID 5036 wrote to memory of 2484	5036	msedge.exe	85
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86
PID 5036 wrote to memory of 3360	5036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5fab68f1994e4531e907febdbbd4a17e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef95246f8,0x7ffef9524708,0x7ffef9524718
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14184077830130870459,298339233878451065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
8031880652e16eeb0f91c0c47295a44c

SHA1
0bf96970100dbccc32a5b67a3dfecce297539b6c

SHA256
059676411e7e6391d37d96c7146eafa4f9bb7e150604fa05e5cbbda338bdf9c5

SHA512
fbec0b1f72ba7c4ebf34cbc96d03a0f4adea9cb1f7f3d27d18c35af8b197969b1bbb130a3114319e246a49158cd768f0ca7d952cd2aa48235c286a1057abd5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
56675bab2d965ee329fb97c8b811c510

SHA1
19770ca107745004a23704de99f8a376206eb7ea

SHA256
914fa66b6843a0ff261e0ee0ee29a3bf9ca6b4156c9ca2eb26718beb7d0d05ff

SHA512
b8a94a20357d8332138c3fd78a1eec8e41c53f5fbc4f6e89005ba9f29e65aca9ac2914cbaf3ef9d08c12b339df1a0c1fcfbe67d402f95048d59b4caacee11a66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
75d0e5b68970e873fcc2fa7d6cd3bacc

SHA1
960d7782fac3f6f381fd7567057414d55b204a01

SHA256
4d985cfccacff271c2b4504298e78be4aa4ef614ab1da81123b6396569146be3

SHA512
20fe33ae84cd6d9a9fd0196a59c15ee14a24efbbb80166669388876dcd4231be41bcd9db2bb41a69af89c228d6fa510a405512672e438948496222c127d01fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eca867046cdf799979f36c5e4b4c7169

SHA1
515293eed3e4ae8197b85a74c7a9b724b98faf58

SHA256
106432b5ea9ca82b319d798cb055ce10ca34ab3e6b2cc8ff68964383e1d33f83

SHA512
32e2fca2235950c3789a41d24ca084ec306377dffc48b870e297d821e3b44519ec87eebf645da4cbc1dc0359d19663687c4443ae6dc9719c8e7e8ce4334f5964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a1329acfa2044320577fb87de87e19c

SHA1
4f1ea3342d8c6b2ac4526a331e6a6b90eeef3f66

SHA256
9987117f66fcefb5b147a0d852a7350caf9efd895a992de6e0997d5bc4836b84

SHA512
2f98ac184906256f33b7cbdee5baf54a528911c4fbdc7f37b665cd086423e5d9e8a82fd888a8aa0ba8548191236964dfb92ec3b7d50638ba4e8a5c42e98a78e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
648f5158e9f24a4d71fa6e51c16db8b1

SHA1
26f64f6731f3c9ac94f8cb569a8a6d1c48b15bb0

SHA256
d45be19e43ccd6cb65006fd57cffd18bf02852e06d0ffc6f9b349224267d0e94

SHA512
1076987191b36d902dceaa227f16e80edde69cc43c99b6601e50da11fbfaec1edf048ef62906f02b84781222be0532d163c81dba47910a58c22ee6f81dc188c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c202959fc425d0f99191d44daa19682c

SHA1
248b2504b051bbacff875c32d1adc4b8c43f8831

SHA256
c9bbe3166ff883f12854424de262aa1c601e506bd1d025696b0a4e6e70afc7a7

SHA512
df47064c7452fce913fa8e1373062f5ec7ea5cdf209967a5726080eb7bbb3fe9677136953b247379fcf4602ca74ec5ca19910f08a9bfa3c25bb30b890b1a2672

Download Submit