f6c27819a7da1b19a546109b16856bf46b58c698d4489915562d6291a579fc17

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aadca464241ef08dc24abd307f0b6c0_JaffaCakes118.html
Size

116KB
MD5

6aadca464241ef08dc24abd307f0b6c0
SHA1

754f63abf6658a95530ad0772a383dee94a08cd4
SHA256

f6c27819a7da1b19a546109b16856bf46b58c698d4489915562d6291a579fc17
SHA512

c4983852ead88ee434fc6f1b1b36f6102e12d15bedf9d2a14d4fe4c1dbb5351f74428b1826a1afce3b8e977c2470c63dd286a30982a454b05147448892e666af
SSDEEP

3072:DkADkAokAIEZkARTcr0uGNMxZPdJXxPTNkAr+SIW4+g4aC2S8EE/VFh7CKVO5zBX:DkADkAokAIEZkARTcr0uGNMx5dJXxPT3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
1628	msedge.exe
1628	msedge.exe
2020	identity_helper.exe
2020	identity_helper.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3964	1628	msedge.exe	83
PID 1628 wrote to memory of 3964	1628	msedge.exe	83
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 1852	1628	msedge.exe	84
PID 1628 wrote to memory of 3380	1628	msedge.exe	85
PID 1628 wrote to memory of 3380	1628	msedge.exe	85
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86
PID 1628 wrote to memory of 1312	1628	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6aadca464241ef08dc24abd307f0b6c0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c046f8,0x7ff810c04708,0x7ff810c04718
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,1864674908597773954,14066872108766869629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
d444e443c4a7c6f02392b62db019758b

SHA1
884680fcf5c8ec397a802289bae7142b21a3e302

SHA256
0b3fb79909f0cef9a1b5d5b6c1f5328967f6b5286606c12b98ec5abad9346ebe

SHA512
baa4d32fd662461d4d2957199ebe91fb800e16fffcf0705f81b80b2aa004477deef4aad215e00ee35ca58cb844c2d5fa678a5fe3f5707480d54dfa9dcd328cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
8d46379b4d86af5d5bca83b127f8bd0e

SHA1
5f77510a0f206f307f9c23d8e20d6247679dc9bc

SHA256
65a2d7597ca7cfd2fd16148989add89496dc6855b4020792500d666aa8e88943

SHA512
19e797a2ee2384105262a56fc3ca8b1cf3c9f8ddf29745de592ab0847337883bb068f61ec10e6937072f871db4b08eaf5abdbe1a38b83f6ec59566987364440d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
082249e837233a5defb706370b8d543f

SHA1
37109c1afec769e5580d36bb4e855c8c94caecf6

SHA256
bb07160ad95d6e349e29670d50221c4f55661bab72c6b97803b0421e21433d7b

SHA512
f505443120a7d86b196f6734bed40e65b46a83e24ea8a6ef41734207b597985a504fd66b3abc33f5b222ec7b1c91e41c28476225e9b1e980694cb027e86ef4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb2491950a73b80f4e8fb75a458e849c

SHA1
07755701bcfcf5e82dfa6276a86cc370d9aeabb9

SHA256
765ac87c4d2a8d50d07464e89dbb092ee66d57d754d26c25ce5f0d25be556680

SHA512
f479e4ef4742ef469869f5da284813adc56512cea9eca61a1b219418ae330ae293b1f4837a72103904edf7ce082e141e58d8c4b84babd3a66c97e396543e4185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bc6e782df16e9400417af30aa1163cf7

SHA1
ba077ccaabb60e1a4752d171858d0c33ce11ac37

SHA256
79c6f07b0d70a636003f3a5bc40945f4f2f75dc4cced45ce8cf0d37afb641d00

SHA512
d96c2d95b31e140f4b20572c794705acc8c11aa8f0c27b92551e4e045f956531da17c62d8170eb66fe02318571be51017a68da258aa33384581d5f64326487ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52194e102d7585a35b2ab6833e8fd293

SHA1
20f96a03aac6c224c0fd5643d8eaca49cfecce1d

SHA256
4fc2a92c0819c0855f440621e6868915253863632455b7821bc3fe3d38784483

SHA512
56afb808b025a74850ada78ec2b99d150b6b4b40e79b1e7c8b68d3e843b9cce92205589541452b404d51f93b9e2d95c5a4ecfdb36e651e3ffb39e9664e4f6610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9221520741a4ffae64062f8f98d0979f

SHA1
8d99304283bcbeb0d02a99e6cd16f57f7e35c843

SHA256
5194e0ff40ca07b14805c968076d8f091024df49e8024aab07ef7d7e97a5ed21

SHA512
d7a3879acf2c5478101f7b0453f96cc23ac82b4e8341452e28bdb98678f18c63034c401be2d8edf52ec7d2f9807848ca1810157d6f07787cc7140656e1605ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9773b4faa5c1a12831d948366016b3ca

SHA1
116bfd12504b3a2332e4f5575e24d061cb4a42b0

SHA256
44381746b3a0f78f5af3be311500d99c3d08e069d5be6bfa0a727bc96f273dd1

SHA512
ce4b66de5664d2b1c6ce4b9e6b03abb750ac659f8773a53c222450aa3cf3a2f7c86f01643a134a964bfb0705e6a6a14086850b8795300c3ab6b3f2cf062be0cc

Download Submit