e9bb576c462725c0200f31c2bad265e732a96351cf43d70ab1d7aeef38531011

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e016bbcb2000660510673f4f0689655_JaffaCakes118.html
Size

66KB
MD5

8e016bbcb2000660510673f4f0689655
SHA1

1b75d6fd293c32d8d752a0ab03876e8912bc2f33
SHA256

e9bb576c462725c0200f31c2bad265e732a96351cf43d70ab1d7aeef38531011
SHA512

d612b8ab62f8a6bcabe7ab7e19ff041e3129fee46c0cc721ad62fd28388898a5cf638d96d31c660c8b3a74a7aa06cc9fa752d07e081cc3ad287eeed7de43c8ff
SSDEEP

768:YYZqkcluTGoHLsTaK59juSyfbbQOyJW/yXoUSky0SjMIbwaH9BtABwRBTN3wYnvL:YYZqkclPqITaSSbcOyJV6LXTN3nnVd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
5032	msedge.exe
5032	msedge.exe
3492	identity_helper.exe
3492	identity_helper.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 876	5032	msedge.exe	82
PID 5032 wrote to memory of 876	5032	msedge.exe	82
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 3588	5032	msedge.exe	83
PID 5032 wrote to memory of 644	5032	msedge.exe	84
PID 5032 wrote to memory of 644	5032	msedge.exe	84
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85
PID 5032 wrote to memory of 2604	5032	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8e016bbcb2000660510673f4f0689655_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad394718
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15210614991676470458,17099690391602737346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
a6ef89e0a7ab89a15444dfc1ea01f137

SHA1
264cf36d9163ac911a9758f5f97b56df897b4792

SHA256
c461ed3ff026a2ce577838e4d221ccbec785e813d1005dc4b2bb660f63a35ec5

SHA512
d58802a155e07a394defd5ae321366e02468e832731f2e1f2abeaada41449180652949b7925de8d86939e35048b9eec873e30a64930687c7aca7f1fce2fa890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
74ad731413a6015b8b43508517f5ac42

SHA1
0621b1f3188b4716d087730a75812a0a45f1e220

SHA256
ec17d99a5dfe8d32f48dad50d7f71cde4a9d5128f363cfac685dbba59bbd8e09

SHA512
9da8b21da5287b13dc97d46703d8efd5e359455effc3477a416f30a383acf619a3cc0861b532556d1c05ca4bcca1a960f1a6a75a9dd70bd478e3c1136d52c945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6ad79e771cfff3efd17f7a03a67012ff

SHA1
0d341d895cadba85318a86f78bc1fc8cfb1724c7

SHA256
3f1bb9404140b0267330a88789fef4c838a507a9e998a92442f399bf24ceff58

SHA512
5dc737845b0eca98eba176c8bcf3fa5cc136ef57fd56963617e4218260b94063fbff14343b8c1365fd9d227323458f20f4ac70b944fe9bbc200eeff0299fdfdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0eb7a93e3cd9d41ecaa13c0269496752

SHA1
ea172145488f89a14b7ddb13b57085d922b49837

SHA256
99ef1de6267652d06a601f771b6bb5aaa57ff529386d70deeb5ea35baa509e41

SHA512
7b04d0c2db51e76f306a2c5e1fb7c8e091c453f055989e957ccb8b8b552d46cfd2338b9be73c67a33f78896358ba44def8fa17189a3c1f17c4d7ec4c1233b607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e3070da42c9fd2fa562127baa53daff

SHA1
578a1adaca67ea11adec1281773e272fe2073027

SHA256
015b3cf73bb83a0a00a52ffdb99413d890f6a27c28c8af896c5c6d3158c81988

SHA512
122d46ec83f1a38104b2e245ef9a3e1926cdae0b9d7bd35ee0dce2a43fc4db27d7fca6948218e00ca718c7d6493b0e0c999e8749b3d67fa6193c45435e3d0f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6b1fb31579d3de10ae5f69936d4894c4

SHA1
59c5a2f52c0682a9c43f4b6dde96f3258dcbad55

SHA256
f080021274676661b4f2076305b3fb8327efb64288fd3446fd2876f13cd59159

SHA512
529b389b6f4bf23c146becfdfd260578604b3a7ba9ed27db5ad3a82c76d3750e05b6dd8cc86bc75b49f59bc8630ffa6c42e92b71e993b8c4282b10e334000d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e2ea3b4609e64f4989467a14f7cd3071

SHA1
40986fd040e0202e4b14d62643fd5075871fdcb1

SHA256
f5583b73e240f6837f3023fe8447157122cea038ba31f5d4f15e81ba601bf4b6

SHA512
c3a5e22ca796b4056361ea8a10890b674b8df69216960235311a43f2d2a91d8ad7455f24fc58a115057b396a8fd98ad87f33a123d124bbb5cf959b51862eb11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6e8c7e07a980f54c256bd8a718cca8e0

SHA1
447313620b40033ee451ea718d2fe5cf27517008

SHA256
ae7ca600acce4e7b4ccfc9c6f545fe53784ae4cbe03d1cd1ff93a06ca83c4b92

SHA512
3ac60e0fbf48cff3a54921f65fcbe0d9b325346cfe4114156c2d38b9f6d56acaab43984f69c5a477818f0aeb2f4df189817175382838d26ed608798622611e49

Download Submit