f69a790109ec4d208c225f80ef05c49bc2fbb9f20334883af0c2d5e994c8d399

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fa16af9d8bdc595316344367a990264_JaffaCakes118.html
Size

35KB
MD5

8fa16af9d8bdc595316344367a990264
SHA1

58b77b9d830451ff649f3f24bb1d309654ad5960
SHA256

f69a790109ec4d208c225f80ef05c49bc2fbb9f20334883af0c2d5e994c8d399
SHA512

7b73221ef8cc39767738da2c0c64c68b02de4af981d14c9ec7063adc129d64f2d7a056e62cf1c1d3a53602343b3c8876a2826feb5862dd1382168bbb4bcc0f80
SSDEEP

768:y55a2PAULKu67fkT07X10NsZAh9fjhIhSaY62ec/meCI:yDa2PAULKu67fkT07X10NsZ13I

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
4552	msedge.exe
4552	msedge.exe
3924	identity_helper.exe
3924	identity_helper.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4636	4552	msedge.exe	82
PID 4552 wrote to memory of 4636	4552	msedge.exe	82
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 3080	4552	msedge.exe	83
PID 4552 wrote to memory of 2452	4552	msedge.exe	84
PID 4552 wrote to memory of 2452	4552	msedge.exe	84
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85
PID 4552 wrote to memory of 1980	4552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fa16af9d8bdc595316344367a990264_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7859341395054421213,15526965934382397248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
2f3607e1b75522a566db5848cad0859d

SHA1
296348a7a67743d0d10efd354c2a07ac6eae2575

SHA256
ecc95fe76f344cd89d447c2577af71ad8512f637dbcccf81c84f8543d18270d0

SHA512
50e51d21fdead7fb5ca8a28b26739b2d033b740d4c6dde9c9b30781676b04b47d3e1052424798b84ecfb6470a6c0a77596d2e5e6a721104dffd9376535670d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
97c16a1c803b97542326511b19bf809d

SHA1
e06efde1086e30c65ff2a7bbbbbebbbf978c9fe1

SHA256
559e4dd5739e86f37e7e7d6401028eaa228dc00949d8174e16bf5b95615c9a19

SHA512
0d34ef3cf85ce593672382336ff101af52e24a430475d67150402ae1ac734a831fe148d318f3caa5a1af9c2487939c432587a6df28f46674cd035317b8151a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1518ac1e9acd330c7fbda9ddfe2e027f

SHA1
db65a1b36c96d824cfa3740a53feb632d4a86be7

SHA256
7678a341bf4f29af50f9a55f5dfb78de365d5f3ff6aa4f2c0f856a63904a6902

SHA512
7f743ad283a145a25bd0b1881d0b66eb419d002b70f1bde52f31dd07a2b6c65fb9a8f87c4f340b8c7d98e88fdc203509f5ef2d2b6da103df10aad92f45ba20c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f9617093b0ddc45f2b5cd02807b16a4

SHA1
c230bac6dbb19dbae32768e2688256f17c756ff2

SHA256
7d2f7608976200fa5aa7b18d704a22f319db0a0e863412a7246d8393e1f04245

SHA512
4ee3406a8d5c269cfc41249b2211eba40f3b3da1101792284b226c2dbb279268b3c70a2b98d458566e03158a7fb3a857f4db3863179cf1a2320b06cd5a012dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2051a87bffc044a4b1b524fdbe58a14b

SHA1
b701534ce26dc60e1aaf0aa2a2eadd038bd865f9

SHA256
eb76c730ccb85321be7d98f47463522510d220f6310006b2a11ebc46245df49f

SHA512
fc098313478b38de62c8de0fe1f9646893d42d44d74a80dd7a32e5bc0193f5207c1257e42bcb57ecc3b9c0883ee6f0484a864e0dae2426ca6647073db941cf0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea1f433effe4072e2a893991a80b22ae

SHA1
04c35976305f4204cc93f125fa304a8e0ef9291f

SHA256
0fad0a14da6ca82bb4c939f86c0b95e2d6a44a8bcc786b154242c5670d844764

SHA512
872de1212f7ba033fd3587ec2d410659c8c872853c30f208498e05f7e6f29655b4b492b458fcd8eb856154292a5a7febb23f24883a8cb9b631eddc662b23c2bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
58b8c0b3f494b67336b4db6f61ab4b01

SHA1
0ecd59cf3b2642aca169013c1d5ad19c36a4f400

SHA256
168aabbf41361b88957ab08452d6204980d669de35009d676b521570a89d1d98

SHA512
b74973598f5523a33c244ed14b6275709e6116fa946ccdcae2a20206055070e4823a0cb7d5ef673bce9855c65dff670d221c1652075bffca101a14e243327296

Download Submit