1b47c37894a9ef4294922260e87e5aa20210b6e5ff0fb4b424bfe872167a0dee

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31038d09c27eafb0fce85c1d9217602a_JaffaCakes118.html
Size

21KB
MD5

31038d09c27eafb0fce85c1d9217602a
SHA1

d94cc5ab99b7323f5c5f8fd0ddc09c6e73f44f69
SHA256

1b47c37894a9ef4294922260e87e5aa20210b6e5ff0fb4b424bfe872167a0dee
SHA512

7fa40324a725cb533dbb0118af924116e29d1a2c68b8d074b67b2786e222716cd6ab61f3efb94387375144553361d459deb3ae2889c4c5a77619a33d8c67c020
SSDEEP

384:Wu6GK7o0lBHsdglQ9SK9IbK+jaITHRb9wibxxLEajkwEwyTTYwxRsxCTUnO/MeAr:+lzlQ9R16b9wibjLEajkHvTTYSRsxCTo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
4300	msedge.exe
4300	msedge.exe
4652	identity_helper.exe
4652	identity_helper.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3184	4300	msedge.exe	83
PID 4300 wrote to memory of 3184	4300	msedge.exe	83
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 4920	4300	msedge.exe	84
PID 4300 wrote to memory of 2916	4300	msedge.exe	85
PID 4300 wrote to memory of 2916	4300	msedge.exe	85
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86
PID 4300 wrote to memory of 4568	4300	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\31038d09c27eafb0fce85c1d9217602a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee75c46f8,0x7ffee75c4708,0x7ffee75c4718
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4625999312865530263,7912866288105255985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d18df285b85d996a56fd66fe1268528b

SHA1
0c1a8adc3c4bf87ee311dd3910284f9dc9c2c7b9

SHA256
0b944075b988c6c74ca343eea76c62b87c629cccdde88d0446b3c57cefbbfbbe

SHA512
87a50ec288317883b129994f7ff0e0ab3fa3d52950993ffd418c1f0acc01f9f039d26105fe4fef92b92dfea6b47d716d45dbb5da6fc587491f284f6a5a0a0fb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
af00a68db6b3e3e7754e2576188e071e

SHA1
91a4fd35f8cf4cce84eff24a65b05841a7cb2fb3

SHA256
238d7ca711565eb2563568095bc8ff27faca819ecc823080eb4c81854e4ece5e

SHA512
38550fb639c0b05c1bcc93a45de04a0a2d56888cc486422ea4f25f983af96b88c097671af9d7c117a76e3e615addefd347df6f35137a4b543e79f35347b5df54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
643B

MD5
868ee567635b43745eb9d935fc396a4d

SHA1
e9efda4e765410e8d0fb7064112ad056b8edd0ff

SHA256
89b03a38ade618ab32039df2187cb46a44a13862474e8352321ac2a2600c7163

SHA512
33a47255c0630961455a27a6b6e895c883f237b7090344c361971b82022af602f455b62125951ddbebbd5e827fc6684876ac63717c5e6cc480eb419f2525b7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
612B

MD5
3508d80fbca56a2b57a76bed4e93152f

SHA1
5579643e3e2e22040f3e9cc3ea02b9e88b2f8c1a

SHA256
8d8d8a8d2ca354611c127d5a696161a6de19a6430dc9a4363c67699d90d0fcc1

SHA512
c01af4fdb7a56fcff806aec29cd5d7a4038407f21fc2d56b71d9d7e156349cce6e6744dd6eca4a06f465986deded9b8e0b547f6ee927d8671ebd530b7a11525d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0033b6b3190255c3fb8bf57a2c617dd3

SHA1
ec1684915fda1e662ad1ad9a5e4a71a7974c5f89

SHA256
7c32978f8c6fc55a768778b32e1890b81148d0aab64ce01e6731cb6e99c66a62

SHA512
0054fcd0f9aab62f6666c9efb60dff846c1d6a7dde31f48864d61dd936cd73c30eb1a6b9f4e2fbb49940a2b292f08fda322c244cd6e7236af37e13b7d0a81bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13ea7ab62815f1d178d505a4878f203d

SHA1
286e8566d1fc8c576a87a220c63fe72be7957df5

SHA256
5d8454e21cbad506698008025a3ce5db00bace51766dd3f6121388bfbf4a5d98

SHA512
5f46ad73c36e01899fd88e09c5dae90f672fef953f03fb4919bfcad7db4bbb70e427227c096320eef4d8d847c788a2471664a7ee1924803ea84fd1171d64d00c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a99a254bcc501a9b6db1994f53cf44a3

SHA1
b21626d751e351a3f65d6bda14f7f248632c235a

SHA256
5df871b0197340961e1a622550316badd87cb66dd3ad59969be5e1112f5a93cd

SHA512
369827b3c2d03ac2691c8cf2e9d82048e1b8011178e063658aeb90ef5b609f4aa3db04b3f14a15ea58c10a67b94e38e11f71f90dca46ddd7dec8276bf1ded8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
236b8495b7c7e4ca060d53053cf05112

SHA1
508cb582803370bb4a453e03b844f548aded450f

SHA256
c1c3596670f6b17ceea2b2919b481b293c82764428961c27c9e7c360341741de

SHA512
3426c4892daca995d2f0ced0a0001d7e4c2c19ae5a6a2d32358f1a0263b8b273e0cff21423acef74f0f28bceea10b3774f39b6d2174bf9d87764fa1e37cb1baf

Download Submit