13ba542d7b3810444cb191bfd1ed77188b66ad0b8c6c073d0135351182c9c5ae

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81dc8a5afe7ff46e4e5812e0490c69ea_JaffaCakes118.html
Size

21KB
MD5

81dc8a5afe7ff46e4e5812e0490c69ea
SHA1

99b2b6ef9a387903c8d7f96a7ecba52e33fc1607
SHA256

13ba542d7b3810444cb191bfd1ed77188b66ad0b8c6c073d0135351182c9c5ae
SHA512

150e896d18b377a46fee339ed0ebb946e0f5d6d807295eb5558af80f722c520dec475d7fae2e026ceee1a5fd19ef8429f40ed7b9c3f389edf42db842aa9418d0
SSDEEP

384:ux5dIdgKIDdim0/exSsKbJguivqDiRsuOS09CDdqBRSB8Z/yufSWJLgE:ux5d3Dcm02UbquivqDiRsudXdqBRSB8z

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
4036	msedge.exe
4036	msedge.exe
4444	identity_helper.exe
4444	identity_helper.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2720	4036	msedge.exe	81
PID 4036 wrote to memory of 2720	4036	msedge.exe	81
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 4796	4036	msedge.exe	82
PID 4036 wrote to memory of 2276	4036	msedge.exe	83
PID 4036 wrote to memory of 2276	4036	msedge.exe	83
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84
PID 4036 wrote to memory of 3052	4036	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81dc8a5afe7ff46e4e5812e0490c69ea_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff9584f46f8,0x7ff9584f4708,0x7ff9584f4718
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17596498674456511714,2466609279557189064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
cd6544a795e10d4031a5b5bc22c35036

SHA1
2625ef6847b1baa1f39ded0947b0597f381363a9

SHA256
748ebf54212fe799289bfbbaced0747bbd6b4c1fbe5d026c60d866b43b95b77b

SHA512
d290e17c7d14beb35f9f223fe1aa793fad973b9ed62abf8805e9dd34510c355598e56eb1adc9d602fee3dff047c358ac119e4862c3c980de3e992e42c6549e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
89a831219b64fc43269a49df9c4c2e01

SHA1
acd551c379c1382b8e7c94b7cf5400acb08a0131

SHA256
0a621a70088b14a02417bf1b1b93063aad04461c48d8420787aa925b167b673c

SHA512
26a836e0e3f218a299eeed642cbe824f318dffc4612fc3b7ecb51f8f4b422854fa48c55c3966a350d312f3272741531cd40615d86875922f48af64a49bbba2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9710939e05d2f1aa505c4d7d6711c807

SHA1
88f471375b2870fbf235109e46586ac3497ad32c

SHA256
db42d97c811d8fb7d45b751e5774e580cf66692c53831444a9f8741949fc38ee

SHA512
66de3e14c796370424f618647371d9cab2a57ccf53260d9bc2a5fe8db00c9bd2d06fdf0b60ca4fc4f1e175aabaad574307f06dd99a17f58ac25a8d177a373e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6a1ef006d3a551f89e85746d01964846

SHA1
7044eaa115a7af84e823421ba1e6698b2e9dedec

SHA256
1a09da411fb1eb01e3b6cfdadd6efef2e41785b900ccb66e52d7a572b982a4d9

SHA512
03de4d37b3f7b8b81d6a6d57d0392cffee9bbe5cd9aa6b99058f28c65bbe21836ba1a69453c90fbdeac83414ea7337d04cf51dfe2317995bc3b981dad98c7e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9251d9ec2d41ce7337da9cee8d9e8236

SHA1
dc92574d4ae4e60c1fbc4439f102a23a33e4d644

SHA256
ba9b2908d69c9fd42d96842a48c3b06365a11444355f2e647839d2fe7ed76169

SHA512
2b26cf6cf2c8c0ddfe001d5582a95d40718dce5f353e4bddcbdff9a21d677fadab0ff19a380be31cd5bd66c7bcaf249afbb6ef6a1e44ebda7d67580a9f761247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66891596669aa773776075df37fa2d61

SHA1
c9eff5d635093da104463d8de43c0b04e22c4014

SHA256
a89213a6ebabadfd210d45603af9b9db2344d7a99a40f19431106f44b256508a

SHA512
9c36215eb38055c099f773f048052a257220aed746fdce9f1a60d8718d80f7d9cae6aaf8e21bafc33c2af2adfc854bb38a12f28db76840366562109715ace93a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8f0793fdb537384142a68b999b5fab0

SHA1
c6f2123d78c65d8feb8b55ed458cc6db9dbabd2e

SHA256
c1e1fbaa98c68e07869f5344e14bd73006e7ac37ba70402e9913e2eb9306f60f

SHA512
4b2348ad3fb8db1bf3b9bb82973e08dee9edaf59ed852f8732ebcfd06766c635e36484689fed95c8f5cbb2b83077456b2dbd0c825bc2480f40979e6afb9fc2fb

Download Submit