8416d94e5a17c5bbf0c41dec3d2cb43060b7ebf286f882e93796d769fb6e528a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d123a179df28fdb8ac9ec9eb749babf_JaffaCakes118.html
Size

39KB
MD5

8d123a179df28fdb8ac9ec9eb749babf
SHA1

ff743d1bfb0ed72c3754a8a61cae5f5b3f6739a9
SHA256

8416d94e5a17c5bbf0c41dec3d2cb43060b7ebf286f882e93796d769fb6e528a
SHA512

5b4a74ab5fd8cf4db63a96b152480deb2ffac40fc704c769104f09bd6ad5c2133a611b46dda6965aca807b2874ffd146709591e46552c7ae90181d3d5ae0a307
SSDEEP

768:zxpsgj7pfj1nUHEJUMYzf3yitZc7YxEuNyUCEAOCm9RDUyLDKMtp729P/:zL/j7ji6YxEu3NAwHPKMtpU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
764	msedge.exe
764	msedge.exe
5044	identity_helper.exe
5044	identity_helper.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3436	764	msedge.exe	82
PID 764 wrote to memory of 3436	764	msedge.exe	82
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3476	764	msedge.exe	83
PID 764 wrote to memory of 3772	764	msedge.exe	84
PID 764 wrote to memory of 3772	764	msedge.exe	84
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85
PID 764 wrote to memory of 2520	764	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d123a179df28fdb8ac9ec9eb749babf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11764691727459991458,11532186890267531745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
20f2a0ead5dc1b863bff08fd0ca8ccfb

SHA1
474fb8538b90e1fb1f17ca3434ac8fc32615a188

SHA256
da243b04549b57d6f520fc6b7d82589f8f3562fbdae0da72b216c1cbdea6d52a

SHA512
408b1b3cb1d1f9759dfc81006008683ff3698eb9de195aa46a9fd47dea749bf766d369cbcc445f61ba7341081ff8d47a4b7f023f67136e355e1641343f672c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8b787123e2d2c785178bba71f6c13409

SHA1
a07adab97d5f263104a860ac415fce27a2074603

SHA256
9162c10a46e827cf89b9f6ff1bbcbe4dab40bf9da7ec0b18da4cff0693b66bbb

SHA512
e859e70eaed24c755a9106ff5bec1a0b87beb2ebc417c155148faf05cfe82e1c3e5e069e41b4f474c9e8b121dff75712bd2b61cdcabe5addb4e72b3de5c589bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
32c555c35562d2c6a43739ac138b6e98

SHA1
b97bccd8c38d64af6a11440d85ca091fb18bc159

SHA256
a342b26eb64f4ebe16e1766825d297897cab98927d832801ed1ddb4de70814c0

SHA512
68618934843772b3bf24f0175a581bb7169958640b8e305fe88f22a6517a8454fed0d8c583a15068683b3ff22ff60c389ec6c428cb05fe5266968edaa7a4f6ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
145bf913ed8abc36d4052c72d87961c7

SHA1
705deeebb64e6b35486faf0f0f950ec657bce5b0

SHA256
6fa5d237d3a45fbbd5ae855a01d3f844ce522a2950dc9d0b799d43db8272f6a5

SHA512
08d3070038994d221ab8d227e8c3b45719c7ad08c5734d2602bbfde6243546ced6ff8efe62f46ee52bbdd7907759ec5ef30cf41ce77dd606eab99bddeab296fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6168dbeff69cfd11e80d0b693f6c611b

SHA1
1ecc535d38ce40fa19673dbb5356f20cacc1e08f

SHA256
17f90c4e854159b46e00f2c3aa07b95bb8e367c67fa7bfc6e5bdb85cbaaf2ca4

SHA512
c6287930a71b4c3a11c256605e9c57dae0997d6511ca023a5e5b1da49ca22e6ab58166c0e96f21b6e95ae40795fc2a0b72ca97bf6b18eec634de7160f47a82af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
41abbcc663adec24b347c8aa670a486c

SHA1
61fd27ef3c27a4a78f237d99184645e9273f5016

SHA256
acc4d07763165068626b8df1379dd72a9bacfa426ed60364ddf12bfdcea6e571

SHA512
87a1e2c75ec5cc300f63cbba3c4e8f41329710eb797a912cddd7f22a0598c6ccaa1a632b67793de51ee0373825020a8f793c536bb160f16300c8d87988403f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5e0319c0cd3866bd139396656272a9e9

SHA1
4426e655df05806b26599cb6956e23552acd8d7b

SHA256
571bd8450681d34afc32713641e5326cf7c8241221e35f831fde1b5f1acbb8b8

SHA512
0b01c6cde41ee9efd353dd64a454792ddced893bd7438cca6438573d2d5b92cc2837a87006c1f3085146512b3a3c7bed74f4adbe4e4cc31d3218aa11dbdd4a3b

Download Submit