61996ee7f284c92e481b9e324520cdab64058e196be7214d1d439fdf018d3697

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f8a5c3c133fec37a3fbfe5eb62d1c33_JaffaCakes118.html
Size

88KB
MD5

8f8a5c3c133fec37a3fbfe5eb62d1c33
SHA1

88860c95193842b1c93681ff1ce498849483f1b0
SHA256

61996ee7f284c92e481b9e324520cdab64058e196be7214d1d439fdf018d3697
SHA512

f509e91acc1ee5399db7b5488b62f4f01c11c76796ad17a317495af58ae2f2d282ed6dd04ae4e6e592ee6775b5004212804fc0416a4541689088c0ba62a837a2
SSDEEP

768:YgOriWNcaSoBgGHONES4OmkQ1gO7aOP/a1TGyQ5Gvp2nGtv4Pm2SLNn2A4C1bo7j:vaZONQOLO+OP/10vhnYMh/VGSbo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
3576	msedge.exe
3576	msedge.exe
4736	identity_helper.exe
4736	identity_helper.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 5056	3576	msedge.exe	82
PID 3576 wrote to memory of 5056	3576	msedge.exe	82
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 4532	3576	msedge.exe	83
PID 3576 wrote to memory of 2792	3576	msedge.exe	84
PID 3576 wrote to memory of 2792	3576	msedge.exe	84
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85
PID 3576 wrote to memory of 1948	3576	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8f8a5c3c133fec37a3fbfe5eb62d1c33_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,426013750306332765,2242905483388876857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
686a027c1e211dd435abef6d4a66bd62

SHA1
ec6c7fbc485aad12ace3c382a6d25e386e3a1b1c

SHA256
13968be2ac11395f46eea4d37f6536bc0e1a3ae286f8047d7a2732b85a01b09e

SHA512
edc0f291412f4ece3c0f25e4604ba267de7ca4a919a57637f01950330ddb1c57216b3ab1939820b4b5daef3867e6ab00256f7a89d1c7b0f53829b0bb989ba043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
650b2c7dead8981e0f51726ef42f10fa

SHA1
8f71dbcd21733469b91581481d65c4c3ebc75e2c

SHA256
c7d998c84c005b1c030c9b4fb9fa81cc3861d118020f55f107e8d7e9de738930

SHA512
3783029ae9c6d0cfe703f90164604e958c85ba3aa721af2dae0372f7cd3167d890d6017b14bef23bbc133ca99cc6bdb92f5ff666c27952d6e2dabc22370a9a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
caf94250f572d99c32a3d786b5543dff

SHA1
d7f763e62b70e7912b09762dd239a563254b32c0

SHA256
6a2d6874d9db1cb13f92fbab4542c1dd60d67718301f83d920bec20366c587ec

SHA512
0b59d0e5ea60b7fc5fb1b4ba515766c9e2fc47764b4052571ad4d602f3dbd009dd0ca21cfc3bffdd454c7265b804f0add36ca0deb5e38548c531d12a2ef8d048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00c8b9340785182dcd6ea58acb463898

SHA1
08bbcb730032526a5c01ac1f16f9586783ff5796

SHA256
41df3c3f5266a293decb0b8c4bb6fd97fb17921f4d96f8ac5a92c5c49db63f4b

SHA512
f9b9ead2496e124e2170ea13fd42f396f4bbfc89bdf006b678be9a06c8af52bda55c22201261d310ee931c8784a272fa0207579e1752e6068d6c7ec5eee1b592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
917993c15ef1461db8b664f276cf2500

SHA1
67be3b06ed643edf6091ef67ec33061e74fec6ac

SHA256
b4c7248ef33ce1f06e60b3256f6dfa056d3d3e48b47a0b5d2a311cb18537d042

SHA512
b87f4a54706856bdf42bf33f509d77fd9933b5a7083a9ae3f94a4b97336940756cab4f13ded86257c7db5c8cb44aa7000ab96d7b86f0ea856f6a3579e1884b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91feac380981cc33a0182927735ba658

SHA1
c872ed9e751dbc484ab55af68b100d93efa3b8f1

SHA256
a4e5c21eac83b515f63be8ef7017c635efaa87abb494986fa4407a04fa10efc3

SHA512
c3cc5f67ec48761f5166d8e5869eaac3eedf1d0ddb5860a9bee766e205233f75f757188e7f25e9cf896a1056ea17dbb5921adf4f50bb01157c4144ab4a3161eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b2c5caaa3ac6a6d45afcf1576cc14b8

SHA1
628c056e4a15e0c6775dce404fc99be3003edf82

SHA256
70a72ecdac0fd8eb9117ed1a5d4a1bf63213c444d1d4012b0cc14a300c369953

SHA512
769e01f46cf024282b340f10494bfe1b02358f93ea5826d1df50db85eecf8aafa0d2fe6baded20c177476c0b41a0092f70782a18d98f36626e4b3610693bff59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db01c68dd104109710f58edf0b8f89bc

SHA1
a7d61fbc0249c7b599b3eb9e6dfcb72d0528252d

SHA256
294bc6365c91e9e1d3363656e033529027f522a5f9c827efe713d1ccda43edd3

SHA512
6de4ebfd46ae220160b03422ef19b09a59dbdf6b4957396cff6b9022cc2ef7ff49aab7f4a1b99cb43c647109e156c4a561eebd5a0b973320b1bbfff3b90be8a0

Download Submit