f4e3c0801a2e3b5e06e40ac03d92670c2ff91718b5d4eb1fd02a61ddf8ceff68

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87242b399430872b56bb7fbbffba8fae_JaffaCakes118.html
Size

53KB
MD5

87242b399430872b56bb7fbbffba8fae
SHA1

612a098f6af8ea6969d144e6581c601e26e34575
SHA256

f4e3c0801a2e3b5e06e40ac03d92670c2ff91718b5d4eb1fd02a61ddf8ceff68
SHA512

e7ac8dc47f55d8b2bb56e879e7031cab8e387506d9aa189efc64da8965856f447ceacae81bd3f877e1c148a0f24598013ceb1bee79061b19b4f0dedbe9c86247
SSDEEP

768:F1uFScACEjDRN9E1wix0LPyTMldQI3p8h+Y33EGsLp:F10ScACEj3+4HldzmYKUGsLp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
3560	msedge.exe
3560	msedge.exe
3208	identity_helper.exe
3208	identity_helper.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3356	3560	msedge.exe	83
PID 3560 wrote to memory of 3356	3560	msedge.exe	83
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 3920	3560	msedge.exe	84
PID 3560 wrote to memory of 5080	3560	msedge.exe	85
PID 3560 wrote to memory of 5080	3560	msedge.exe	85
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86
PID 3560 wrote to memory of 4348	3560	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\87242b399430872b56bb7fbbffba8fae_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fe9b46f8,0x7ff8fe9b4708,0x7ff8fe9b4718
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1354873135923975048,8220352121146147878,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
02807b906c3aa9d8a9cff4d6c8cb696c

SHA1
3d05f17f9e7d9cbfe88d6fe41b52f1184f976fa6

SHA256
cb115cd90a6799223c104708a0a422437491d11cca0a7c90fb664a47e50ea1dc

SHA512
76f85b1e14fb8a4a76b9099788a3f44b372723b8e2d4744a98f4daed0705470a6165f76b6c8f32e0d6846185c7752db21c2493828e001c482bca0aca6a98c6cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
35e9c5af994d8db3e8517b7314a1b8af

SHA1
f6c91d7fc1ef6820ea60ed59eebc82a18dc5f853

SHA256
e11e057bd969528c93e981755f63531fe523db9e24bc6a4c4205a7b6e39e9835

SHA512
f12ed03a7406cf2d545ecf362f4c3eaf10f97603f3f0d6667a0b70ad1f0180ce91d893911d460978ff4352f2d9ed24d597a8169e3011f010483ca61435ae49ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5484a63b84c52dff0922cddd8eca3dd6

SHA1
6b76397cf965900fccb991b61d4244f5135c22de

SHA256
cce3fbf014b9ca5e62d0133cab565cb411094822f92fae21b5c4fd276f72ab14

SHA512
2cbb9875b62136f38363d53633b7c7aa1f4a3f20cfc880aa09144d64b5b4629f61fe72496115c2ec649cb0d50a5ea8f7fcd005efd47759643e1ffab06aad3c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a11c3664a4590548a5ede9b77896732

SHA1
56292bf4879ca5020e39023554eb2ad70e77cbaa

SHA256
dc473dea08bc124d0058261a1a2668a026abf5f09a3275ad62e115448b00e0e0

SHA512
5a5abbc842ed5b2f40b32d1430b10a05c07762cc89ee0f55eba264e22c94d5e17e62e4465f12df97ea9a9988ca3d10dcb36ff79eff2d0a3ea8563e30e86b3fc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
221346f256ced70dd56542664ceeef67

SHA1
8828a9c4acd6cf094e0f92d6db3e56da72d8ce91

SHA256
4d55f064ff9d04449762c8f9256abdc6ad5d9889235d2ec9e5088f6c5a327fda

SHA512
424bc35717d0f4d7a69e70d0044dcecd2c3603d66fa3acb5c36e348f13de021d0f3fda5ce33c817a85006ab68cf2afa785c85b629d8dbbc48652dd063f9831f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb63e75d825fd4a288490ede02d1b6cb

SHA1
c618c4c52ba95c531babe8fff355ae3698366d68

SHA256
98c57d303361e14d39f1f87d93915a23333b27a6a6a0af8ebf1a7f0f6dd81467

SHA512
03e4effb9e4f72cf1e4a8cf4bfa1238839c800d07a838b49ac547e77ab72b4addb9836cb2c81d8c1b345b00bc5c5e957fa6212ec2622bd49c2ea3b39cf63c083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90ab7d5891f4bd25bc48ec85aff8eb71

SHA1
7a7afc8ff5dbe7ddc6f3de0139a555d8cca5c5a1

SHA256
4b5a9ea157b3854c5d4509e92ff3965e088ad8a12bca3c8ee586e6297939519a

SHA512
1fbfcabac2e564e8cf1d74e517ad183e4317ae322976588525e808e4884554b76c1335d18ae4f6e50f7ab5eddc39a33759dd290683090cd2600aa2b359045350

Download Submit