cfa2eb735c208e2e0f93f03ae425544e0fbaa46f2a804b8980dd1af1ae9b82ee

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33b16f39d429ac6226ea7780b0f4c16b_JaffaCakes118.html
Size

19KB
MD5

33b16f39d429ac6226ea7780b0f4c16b
SHA1

dd5449a4ad74f6b250bfa10aff6fd48aa428e35f
SHA256

cfa2eb735c208e2e0f93f03ae425544e0fbaa46f2a804b8980dd1af1ae9b82ee
SHA512

4039a03da1e72bd9b11c045cca740fbed04537970c219f23b279d885aeafe48d7e94b0acc79332c8cade4f499ef88a73890456eaeca9da363f5533b7b7185845
SSDEEP

192:apxsiVGUhCB5jcJ0ByP2BTjL9jEypfZVqxjdwMSnqz9DAO0uVRmrtRghUtLg7baL:2V5IcijrOQM//0t+Nu8pSLoRUYUJwX2V

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
2756	msedge.exe
2756	msedge.exe
1212	identity_helper.exe
1212	identity_helper.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3236	2756	msedge.exe	81
PID 2756 wrote to memory of 3236	2756	msedge.exe	81
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 3696	2756	msedge.exe	82
PID 2756 wrote to memory of 4552	2756	msedge.exe	83
PID 2756 wrote to memory of 4552	2756	msedge.exe	83
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84
PID 2756 wrote to memory of 4832	2756	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\33b16f39d429ac6226ea7780b0f4c16b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9da1d46f8,0x7ff9da1d4708,0x7ff9da1d4718
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,17413802449404599718,1644537595932836845,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
e131b728022601fcb6e59b1d4919cefe

SHA1
212f5bcf6c7795ce869f85eb13904bef9ad78f75

SHA256
a310903c357d4f7d295b056b2fb8db164099ee966c87911332cf038bb889bb57

SHA512
c34b0019857bb849062a8b6e1c98530ada29a9a7c5349269a72d2ebda5ae0394eec8a1fbc79f8104039fae8f348ba588a45009a13dfb51daaf3ba50634ef3945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
03241407d07e543dfada0e9a729ba379

SHA1
99aedbd618be4b44d93ca160d699ab4aed35705b

SHA256
a21c323d909ce1619ed71a26c1ad48a3e89ee5df8f78c492c20db9f3c9af2e86

SHA512
250252203fa30a4c1e57d308e53f36d5c314480b56ec355a756f9d7f8df68d0d6b8be59bc39ab63f2af4bb92788a4303243d647119827b3a36aa5a0dd6556e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85d099fbbbf4c59f7450cb71ddf45186

SHA1
5e412f5d31f835f722347ce5e30120e4d6cc64f4

SHA256
dd5cd1dac9e65b1ba0eafc7a92357164271f6155aa266e57adf815f192283418

SHA512
3a2647866837d7be82651f80df9008e7ea0d50e1b6cd73ce6ef8e2f6264bdb5327c269dac79438174bfe2216b0801b84d13deb2f88c1355f4f144eb28f77d766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88240d00edb2796005cf6c8e8fdf1b12

SHA1
b55aae76e559ab902bc2d6444f7fac8e2f0dd141

SHA256
abcc7bb430eb5b04f8079bb0fc21ef885d32bb60cf86ab892ed9615918d77a7a

SHA512
301cc12201af53c0eb58f43d646313d41a769858a402cb9d14cad864a27c9ff747df719b8b3e780ec4677d384bf9315dd951f14679e9dd06443448a8a63993d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89f0bdf550da94cdcad4354e3a02fe6e

SHA1
a3334cd92992b9bb2175ef948407610f0369535b

SHA256
edb5ada50f301bf8bac3bd31863a948fce94ced5710d975548335df63bcf67c2

SHA512
8bd56517dd98b27db8b24ef5645b23a31d23e7442bf33365a7130789958c9bc72cbb2e4c22739a7aeb3d587576ce96270dc36d804ec339b23efc35432721be5e

Download Submit