586add697db5cde2ec513cde65efaa7e2b3fbee1d0304eb33c4d39ba95774ef1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ab415f81efb6d9c8ee95d193047eaa5_JaffaCakes118.html
Size

175KB
MD5

7ab415f81efb6d9c8ee95d193047eaa5
SHA1

239adb5006dbb52d4a95d3a0b71195af9bd16c52
SHA256

586add697db5cde2ec513cde65efaa7e2b3fbee1d0304eb33c4d39ba95774ef1
SHA512

1d0b35ccd26c6c0bd49a425ee0d37391da66675ba943e331a69fd10f87ca6613c78aa1ca9be69afeb874952fadf06bb0d44139fc3b28b24ae73f11b4f599c632
SSDEEP

3072:CT3IQzgmw7bmMunF4309Diq4e4pU7+WviY+9aGlwZj7h7uQbeMB+JFm:I43eiXaGld2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
600	msedge.exe
600	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 4532	600	msedge.exe	82
PID 600 wrote to memory of 4532	600	msedge.exe	82
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 1256	600	msedge.exe	83
PID 600 wrote to memory of 2856	600	msedge.exe	84
PID 600 wrote to memory of 2856	600	msedge.exe	84
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85
PID 600 wrote to memory of 3168	600	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7ab415f81efb6d9c8ee95d193047eaa5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad394718
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
01cba16162834fc18a21713aba4ef28a

SHA1
cb434c15fbb4fd0c5faf34cafff4e5e8f882f468

SHA256
c605d4d8ae6542c0da5dde62587f28dce282efc8908e716162b759ee6124be1d

SHA512
995f3f65b350f530964f1b105773bd1c793746b32ecba63bdaca792b7117388e9dc7f0e8461e1afeb47c68c8aa45a2ddb54851ffe0a887a5236dd98d11d21144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c8d2dcfce5767d194a177b0d1edad4bd

SHA1
aab040dca9c45d4af798b8d431c416e7193e72d6

SHA256
7f4a0d11fd9516376a53917769d5dd87cbe8de757d536450acdcf7fd7bed54cb

SHA512
28969f689f512417106442b661069d4214d1d8feed3ce1a0ad8065073a0ec8d8ba7f0bd757f1a6278a118375b18ea80fc43932cf174d209d37df1200533d7bdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c127e8444d5c11cc88df615c9ba94f37

SHA1
6d8ef4a4c0e962f33c372ade4aa5e2bea47b2f89

SHA256
20127e88848e3d57a757aa78a13c2d17dc3d7d32f6477567259a475209ff2db0

SHA512
059afc7a356c107517ac0448601cf056a3b67900df9f7231bc419116371faa95da753a359c4254ccf4e68c8476efa907edc6964e4f74be069145614d06e00b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
315c634f42cbabd03fe47395a8753579

SHA1
a79fa494e873eb5610ad2976f8e005ed6cbf1dc7

SHA256
82427385ef27bc81bdcaade0dbacd88fa7b969bbb2dd75578ed952852d85bf47

SHA512
5dcd746121efbf9e1b4cdbfdcc11b917436903265d491e8f711ab048d1d225b6a11717dc35b9ddbe53f082f98fc6338b6374b06398e8151974128df6d42a07f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
efafd0ce3c2575e97e2d311af1377861

SHA1
2c838adb4b01e067f140522281b0d680c4591f5d

SHA256
906fac45be4a715a9bf099c83ae44afc12a788b846908ee96268c0b2a059f6ad

SHA512
05486ab96ecf7bfbe476ee3762719cb4d4dae57c772394ac69da1edbc167dc095f0a86a5968d8e47a3d1a820de762857c0a5ae9a03e034b2c99f2b01fee3beb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3d918224570bb484b6df95478a96cd3

SHA1
2c4e1d0a434fc7eb55270ed7f3fcf12b3a0f883a

SHA256
f041b0f77701b8e8b0942928c328d1b8be16caa6a3d3b6a7d18fb5e53202dd29

SHA512
ad1be671bdc49ce6a27de9040696e9ac3db646376ba6d19eab614936e36df155486252efd005c3a229302d54a5b889fa42685b8bf327dfb4afb11bfe61ac1186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98c5e315c09474ca4e45563b8249d050

SHA1
bb33799849351bcd12063859d281ce2c8e8fa6d5

SHA256
5711488731f4dfd3d1ee884a17b34eeb5e4e83e4917958bbffd773a08c0286db

SHA512
bfe6248e0ee0ee279d9ef3a6c7a173e6e4ff823c35d56e688f1db4aee3551817f59efc5c02c32e6a687b931b106c8e7780c77581ae716666cf79d28694698b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6a8d225b9949dfd41aea6fef15188bb0

SHA1
18429ef9f008d02f3289d2905a002c5954919823

SHA256
dd971ee7b4f7b0fc345ad904a04397aa1fb9a819582a2fb13bce3daa64858ebe

SHA512
94c95ff0f87431e975d73c1efdab83f2e98730ee9cae4ae0ec9bb4d938dd009716353caaeb31f062f02f9dc641138823833f10ebe1058e33134774f8f486444e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e089311dc7288b66eba0d40166a08ae6

SHA1
ccf4a079ee9e8486c0eb3f99303eb6f2f282edd3

SHA256
cd8e42b8d9ddea5a6652ff8b4d62f245fcb3864498c4e6ac2ceec781370c8ab8

SHA512
fa709697cb721bd909908b7b8098b45b51a4601695b9537977be66699b663bccb7adb68618b9182e395d81af877f048bfbd8dc212a45313b3e70d71ff99ec373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aea8b8ae99e0604083c24e2b710d7c40

SHA1
51aa04cc7291a87de1b9499842cce4ab0ea7366f

SHA256
880541bf152eacce5fce11e620a99b45edb5e5a46daef15326c4deaa58976055

SHA512
0496b25827c5d2fca335e98cf218b1465d8083f098acf2739a27e0bdf6b807e78d50117f6dcfaa9a6942b1c47fdf017164f71277196936474ed76f3932c97ce9

Download Submit