a262aedb608d22c8fda8353c5afcd4e5b4889ab74e768a4fc0bd34c1eef3841f

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b1ea73dd347dea1d492bbcaff6bf5b1_JaffaCakes118.html
Size

49KB
MD5

7b1ea73dd347dea1d492bbcaff6bf5b1
SHA1

bb69a655325e3c9efdb06735d2b2484e11087ce2
SHA256

a262aedb608d22c8fda8353c5afcd4e5b4889ab74e768a4fc0bd34c1eef3841f
SHA512

2f852f63fa1a8a541b641fb23e0d9fb3699bf606ac5c949179ebf9006c69669823f523475dd15a8624052006f3f47298ea2fa98d8dcaa1b0868ea50fcf086d74
SSDEEP

768:z6pnmDJ5ipjXgG0EBTiKOjKQrydzwMlLDF+KMtdkR29YZ:zAnCipjXCEBTvOkLD8KMtdkd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3748	msedge.exe
3748	msedge.exe
1976	identity_helper.exe
1976	identity_helper.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 1116	3748	msedge.exe	82
PID 3748 wrote to memory of 1116	3748	msedge.exe	82
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3680	3748	msedge.exe	83
PID 3748 wrote to memory of 3632	3748	msedge.exe	84
PID 3748 wrote to memory of 3632	3748	msedge.exe	84
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85
PID 3748 wrote to memory of 2768	3748	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7b1ea73dd347dea1d492bbcaff6bf5b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb552146f8,0x7ffb55214708,0x7ffb55214718
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4932224590392170978,103637422301388005,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
95bfd3a1e88b316bd0cfd5b524bd08b5

SHA1
24d78cd524bdd83229c5c31ba29dd0911e25959d

SHA256
cff94656c8ab57b6dd4b9a7e955d2804eae1a18a22f52319af71198ddcc4d04c

SHA512
6769b2fbaf20b27cec6fd9fda57a4e061339d4ef020d36b8167ec63e1872947539c5cdac30bb26dc7dda8c5debb33ce5bf4089b2ef116f220e9f00f2462828fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
50417d8769b542f77900c82d2357a4af

SHA1
3ab5800683a98a857e38cc136f22bf8118257c38

SHA256
70ba99b7de05df1fcf396a99dec1a3454f30add0ea6946fbb49427c5b66c0ee5

SHA512
e2ef9510962f573348c1ea3abb3df36f0675e870b66e58d8700283e1810834cefe3df8ef6ea457f42e72e7229106ade4282caabf06ef2d60d359ec89607d4c04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c3356b3aff7a19675d889de962bb4c68

SHA1
bca150097618cf9b02cf7ef332c547c0df4b4db1

SHA256
9fc9ad73fc3bfacbdc7ecc7591965e3538900abc3b545eaebe3dcfbcd2fd8db9

SHA512
49ab60fc3242481b50889121ce8d73b05610dbfd5f673779d93a499437d130189003542713c613199650680a4fbf7ae898fa597ed6b2b4ea5777d1eb5396993a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
704e6535b6c60e0574c365851ee0e38f

SHA1
98d47a3d77b0cd0d198c43d35dc3efb24ff07163

SHA256
9fb06e88afec0ee3c6048c7fb1381de59084947d7ff2592ab35edb7ed8167861

SHA512
9600756d6c3344eaeb9176227adf8fb2d760fe326a3c503f35e2a2e78eb64dfb8d709ef830027212482f61054f68a8742e49410dea91db8e15332d015980676c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8bdbdc9a1ff3cf2e7c40023a6ef1f2d4

SHA1
5d11bf2734a8a99b048a4f8277d354c82c3286ca

SHA256
af88a2007b83c4b92c301e6fd46c35aca27c93593ada9dc514555813f756b228

SHA512
ab40844796d16a460311f69ef6faf50989b23cf89d92d072df38b8dbf16f2a1c39ed702657d6d2bb860ca3c5da313a090e85825800b22cdc7cb05dc6af865769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
76fc86363bcc1326183d5e3a69b9c1ec

SHA1
5e30814ecf21605e675c333ba6a0657e2e84085f

SHA256
081ff229cc852e494c2b81d91c2e821f3aed3b1b86d741187419b47b9d79b3be

SHA512
145b81a6eefb5572c13ad0dc9cb50ad60bed89d8dc72b5e7ce3cd3fd3fde5aa8c54323c880aaedf18cf9c6c0bbbe35ac6ec3642a4aa783a7f719459cef851c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b179c25a2714a31e3d414d193dae676

SHA1
91705f1feaaac5d527caf7bc85cfed08efaa3e84

SHA256
524352dba9c6c100ccadedefa90bce0e457559e3ba69053688c1a05199e5b27a

SHA512
d5e169dd5955d9123737a6650bb04fd3d8887d18ccb28ff2a8847fc6fe427460f77f42a13d5e585914f4d6086d90ac7faa58acd16a418a58f01e5a03002b5f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
625e756908c28a862bb5b21355aac53c

SHA1
a290fe6cd9aab3d9fe879953cf865c8a7dc2a85f

SHA256
b74b4fd7db8c484bbc74a29a3809612e0dde72450147183387704affea611746

SHA512
d45352fca2fcf835b94ad6c618808d9b1ab1f5c8c5bc807f1dbcb67f4eb90fdb637c71e54c531fcf88c5ab7bb276a9ccb86683916a093671cdc8387a39061f88

Download Submit