39e8123c0d9d3843fe970b52efd529320fcfc5de8624616ba3cd0b468c45fbb8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

659924679b9593f1255bacc22b1f19cc_JaffaCakes118.html
Size

132KB
MD5

659924679b9593f1255bacc22b1f19cc
SHA1

c20f438417716fbd88495931f5fc4e0d0fac5f4c
SHA256

39e8123c0d9d3843fe970b52efd529320fcfc5de8624616ba3cd0b468c45fbb8
SHA512

ff05470c68810e27ed9bd7d798805ca0cc5ed50a9f3f9fa73adac3557677e1325fadac3fbaeaf66f5e1baa9cc733cd8ab91c7130606d48a8dc7ed0235bc75e36
SSDEEP

3072:f22ALzeHRM7Nwc42EcEZf9yWQpOk9D67fZb7hUWloczBQ5j/:fUUk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
808	msedge.exe
808	msedge.exe
2284	identity_helper.exe
2284	identity_helper.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

808 msedge.exe
808 msedge.exe
808 msedge.exe
808 msedge.exe
808 msedge.exe
808 msedge.exe
808 msedge.exe
808 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 808 wrote to memory of 4472	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 4472	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 64	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 5016	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 5016	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe
PID 808 wrote to memory of 3520	808	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\659924679b9593f1255bacc22b1f19cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dd7f46f8,0x7ff8dd7f4708,0x7ff8dd7f4718
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
2⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
2⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
2⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
2⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
2⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
2⤵
PID:508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18344554616371506982,18044134503957029184,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2588 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
091a31dbee03d1b1e419fd40c2126b18

SHA1
4783f1aa47e4496cbb6d92ebfefbc1fe3f52f56a

SHA256
d973fddf3360fd507f7a401afaca6b49ce784db5d477b83852c484a8c97d4b21

SHA512
101befa3e535cb49732e5ac69844fa9cb084c43e444c2c991d3596ee65e1f9f276adefe6c235beff805bde1901f9e852b0f2b6a5bd8788a4497e0ba8da2f9d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4011cbd93d3951d324781ed4423cfc04

SHA1
4a988430fdc243ac45b7b53ac2e498b24f1762c9

SHA256
673cdf85317292abe3448a7cefc758d85290871d9d08a634e57f23b2ac23c728

SHA512
97910a80d3489e777ecdd19858a24d2de80fdb1294c7d5100f17e5de0c7c826a0248467c04fbfec80834e6803f89075e958b93adc20f896efe28be0159d6fdea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bc7479ed09f02cd20a821dd6421396c0

SHA1
a8ed4339d55e161639166051c7ff4bbfa180e156

SHA256
593fcd1a7776ba0d13cf11cc3c95782a0cb7625cd9eaba1e115b15622fe51647

SHA512
ef44ce89077b14cde84b42fe164d32971d0919a57e0e44e6b99ac5298d14d5c47c7eedb171673e8cabf3f6eada0c3028667955b14977edcd0923a3954ee330cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e8d66947d70414440ba563817e357b69

SHA1
7851fb60ac2ee37f0f9e1c094d83311d0be74870

SHA256
ba5a4986935cf7b581d1410953d08af581ceb3d35f6a6ecf20a727b997f3e034

SHA512
175c6a41c73bdf6972f3aba39b9492cff12ff3b562325d5f1b16985a95aed3982a3e304b7c6cfa99dbb9b6126d24b94b5b296d69b5186022a8e6b8c7841b9c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3114adcfea6d5cf1cf873aa3f083ef16

SHA1
da9be9ea90f1466f2a77e7d1451634bd314a70b4

SHA256
9f9a1a92ed070d7807204f522c1e6fab14c66730a1580f57db592caf6b8b7c0c

SHA512
0a14c975fbd03b7dbe59b358f4a3d9c82bc82473140d329e92c948d6577b2f2b318f492f5165ca01202320b8795ecb8462f4406e8a390c5358e7725ba3be3fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
979c887aef3b641e3578880c7e64c6d7

SHA1
ec5dbe879ef4f8fac2b37d9e01807aaaca8ad4a0

SHA256
6bacde7359f99d14270a48a73091e5b946e677487b1a8f42db968594ac23a4d2

SHA512
749897349ca47e5e738cbbd57c7552bb4c5ed559b9780dbd7afc18d280e66bcdce4866ce1b857962694e3c78864d8703651dd3006be9fb0393bd07f789255f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0403ccc8467a2640b70884d4d1563987

SHA1
8e1f03db929a5a91ccde84a8db25c89f930ab6e3

SHA256
e87da7a72e4b1319d8cdc0b476258b359d3c89d8a2adb188bb3334b33a459648

SHA512
91f9798a33343c86e8c717f0e3e869a6c08549fefe83f81cb249426a96e8e303fb9c5d80cd4d70585f74a49cc02de0cab2c0279568d635d67c0e33e5b5b2a061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f2eaf8903b9b147f0c3195d388f0b0ce

SHA1
aadebc0d034a6a82221c42db43db58d91c9bcffb

SHA256
a348fb3483f9bb92888b788b0cd38bca3b71b2a8b4ba67b5533a032100bceff4

SHA512
c4abb6d6a413cffc788776189a4f6d4f6fec1d97aae8620df0c26b2a4eabebdfaeb867dd4e32b0fa5913088cf770d9eae03657d6a8eef4570dd614f816702281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
19fa4c7a29b4eabd7c6e56b1ed0ec69f

SHA1
e5a97e2aa80636c16903a7a0487c72a15de89598

SHA256
bec3e27d4ca5176e1e4c80869e4be1269f9e057c49c50e89ca181fc81000cd72

SHA512
79fae287bea23ad7f53718da73644463890e54f04f284a18e7e3280b0642599bc4a2ca246dc4ae2a1ccaf82e865434358d1eea0d13e24505e24616f6c8e4834f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6602ff84a1daf3375dd7fc599138179

SHA1
415a55ffb4fa81c5585b17968e2c78983045b111

SHA256
1c630be805a4337ae1eecb7edd3301a71ef5f16920b6bf59e9edb1ade279a130

SHA512
fcb4c876f805d5c91067a697ea5f4c49c71298503e0fa5f17d4fe7351ee2d5fb4567e32bec8467f9727d1e51a79e119a1df72b2ff6ac2a0eab20961acb79cbd7

Download Submit