d0383f2eb9c1e2e5894d8a30520f763a46d6bdba8bd4e640ce639d3c28ec3f3b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99c5cc66e96b5b5803bb17ed890ecf3d_JaffaCakes118.html
Size

53KB
MD5

99c5cc66e96b5b5803bb17ed890ecf3d
SHA1

66566a13a18f5e5aaf81820e72147aa2bdabb81d
SHA256

d0383f2eb9c1e2e5894d8a30520f763a46d6bdba8bd4e640ce639d3c28ec3f3b
SHA512

2b2112cfe0615f9eaae9bbcc4147b65e5f28896808a76aa2fab5d6a7ca0262d6bfab60cdfee2fbd4e7d7e5c83ad7dee9c22a82195d60ceed51c47e60bbbd650e
SSDEEP

1536:SiSH4v3ts+GDaRf16xYCuAr28c0ZGgSYNrCJjdJkiy+jTlTHfNZ72iu:S0a+ZRYbQJkiy+jTlTHfNZ7Hu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
3480	msedge.exe
3480	msedge.exe
2552	identity_helper.exe
2552	identity_helper.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4664	3480	msedge.exe	83
PID 3480 wrote to memory of 4664	3480	msedge.exe	83
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4380	3480	msedge.exe	84
PID 3480 wrote to memory of 4216	3480	msedge.exe	85
PID 3480 wrote to memory of 4216	3480	msedge.exe	85
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86
PID 3480 wrote to memory of 1336	3480	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\99c5cc66e96b5b5803bb17ed890ecf3d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6413776738779903788,800171484816099733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
cf6b7262278c23022265a5137f69b460

SHA1
b13d974d8731f54bb6cf9958a5f699d3cf825017

SHA256
480bfa202c57e1350a43379162819672f652f081aa61e7f322eeac8ab0cc81da

SHA512
6394a085bd2b2d8bb74896a41dacf6335e1ab56c49ab5286202f712b9cb3fda301a1381dc6f9189fffcbf4c930ef3ecbc9758a71d735877254aa5b4409ba6d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b1a4b4ef9ce545ad065c425d1aa9a254

SHA1
2295f42e5d14edf6567f1ba75d649ecfbbf575e3

SHA256
8da7765c4b7842815dfe6c7bd47e47293898a88f61e9e9d3f0053bc6b6092540

SHA512
110b5ab0b477d7863051defa85b6d4959bbd23c9a1ef60dfa1f6d05583a18683e5566feb417b902287ad17c266684c85705ea3d407ff20f03be12a27f8559ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2955759fc8d6b195f072b74d981c0221

SHA1
7950529576251ef3207239ff366c3f9e94005b8e

SHA256
daf80c9b6f448ded4baf0d7b350604beb1f097521ae16d247b3e45e33d91a411

SHA512
8fc7c8e6e44c03686e24436d3d55cb02e5131bf14df99fdcbb618f4e5c5143e78234ad84281b8b5467b19342c430987335c2aa73df11248785e4af6b29f048b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
84bb87a7172fe5d985761888dd0b7c6c

SHA1
d8bf0d721c4c0e892e5469533096fb4e82441942

SHA256
23f3773f63fa88b8977ffccb566ca4698ba4bccaa8da370e777317bd2ead398a

SHA512
b21e84d3525035458cda6458e3fa769aaf07880d076f007c88a828e1df85a57fc4b9efa383700017b29202d66df9ebf40434c19091738743c354d75238cebe40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53acc69240c12387d0b55d64648c600c

SHA1
09fc77413ad98d6db18638b14426240f8eb1d440

SHA256
dcf03caf2632d5081dd1d644886eaeff142b7591188105b566de63df3004baf5

SHA512
a90e45c1dd1fa39560da07c4eb3b796ef0cf521de39709de7f3d872ed9171254886b768ee377239e6d0639cc1b9a6f894bd8179765586be01f12be3c977e5b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf66dbe7f5e8aa679debd9d855fe5b19

SHA1
dafc81185bbcf09469c745addc8c9e38203f849b

SHA256
1939f8c05dedc8b224df5ced4b4497a3be1468bcf0eba2d7b587d5526e87a70d

SHA512
f3a66f45c6de3bf024ae367e7f6cba59d36285932c4437d48f3d220a57c2fec8e485f13fff7cb57ac5e673670cdd275f9e87d763f10d539efd538ec9dda033f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85d98d7bc815e092350914f5be379b13

SHA1
3355c88600622250788946f80c319286c78438fd

SHA256
33e19252b3584bfe04097ab356383352e36cf5048994ca083c58d4f604507a6c

SHA512
5824f070c015b50fafe9258a54799d330957d79ae8a11788e01ac3984cecc0d196cb4e9cde6fe511894345005df17a017a99fb37a0d8e245ca7468dcf696c601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee5c59a84df43a48d71727f9a1d594a6

SHA1
a21256f6da6fd2c3384e32aa3c7518c1feb913cb

SHA256
68842319ca3c052769d439ad9fe857f278d94d5e6d1528ae56cc9daa28bd717d

SHA512
972e52237ef3d379be8709039a93bf429635fca74ea824ba8df21d6a7e7d19af4b6300c496491fbf8ee7cedfe0245ada65cdae06dd3a33ff496d5ce4f9cf4c56

Download Submit