4564ced3d58c1a3a9b9fe056c2936dcf6b3ec410ce99206f5343873da881a125

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

105db83e61266e72d2f6f612c0488428_JaffaCakes118.html
Size

53KB
MD5

105db83e61266e72d2f6f612c0488428
SHA1

35167218e1faee60a53bd15370b3df92b067713f
SHA256

4564ced3d58c1a3a9b9fe056c2936dcf6b3ec410ce99206f5343873da881a125
SHA512

fd79f56ab031630a96af5c50d0d74fe8a38cc94be91741f0da6abba55a8bea0436b06227cf285fcdc8ad07005d471dcf0e79b7cbb027a34e502dabb863091841
SSDEEP

768:/pHvvCIoYeQpynDJZe/IuQkM6Bnbbnb5dLFr7jT+Gu7KxTgpIe6x5ixXhXVr+Q2i:BHv7oYbynDJIrNldjWVr+A

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
4820	msedge.exe
4820	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4736	4820	msedge.exe	82
PID 4820 wrote to memory of 4736	4820	msedge.exe	82
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 3272	4820	msedge.exe	83
PID 4820 wrote to memory of 1892	4820	msedge.exe	84
PID 4820 wrote to memory of 1892	4820	msedge.exe	84
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85
PID 4820 wrote to memory of 4580	4820	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\105db83e61266e72d2f6f612c0488428_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe8a2246f8,0x7ffe8a224708,0x7ffe8a224718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2782896506977723461,14620785887794229795,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
a4ef06bae11642bbbe2751d5f52d7830

SHA1
28ecf2c6cb78e515aad4b42cde73ba9dac994a83

SHA256
a3fd8b91f3dce8983967c4d47cb31c65434f85cfa083a4f58ae5b90f9baa5de5

SHA512
821bf5dd8d0d7e6c9822984c27607a45d17473c94adcd3fd9294707c63646337ebcb72b48883334c6408f0e96fb2e94cfd4a3140dec72284263e38df6c4ede17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9889955ea1b34dad917d276aaa5778cb

SHA1
8f29524143693eab3d09c97f9884361b8ef16553

SHA256
c1fae949977d18103eaf0020948940d4da9cde9af2cc390a0d1977573a53faca

SHA512
e6314134974fe672c2a8cda96a272a717938cf4eabdc5f711d4602416b689fda51e33fd8bf2821657bf0d60a510a20ea58296b5024f62f05e8b4984bb522b8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9480ce4c2594cfd00dedbace31be287f

SHA1
0eaa2ef2b2dbdad7b30897b50effe376c5d7f690

SHA256
37bc500621bbf8edd902b1f91f37bb2b1a7e7a2135a18b0235acd0793c1d481a

SHA512
ba4b2cdacaa30da48e5e97c7c77d4898e95305b647210599d51f38a1f86e57da054481d7376c5078fe9f88e623f6315d6760614d32266eb572e1dae6bbd90a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e060550b0b3a627a28c86da6b543f7ca

SHA1
4dcb6be178102357e875d16e5bd7aff13c69d196

SHA256
1b6b459e56b9abcac46555572e2119fd07371b1ed950792a7af4340a2b02adbe

SHA512
315c6c4a4e1eaae5c3c52ed0642c3d551c49896345c9bfc7d8dd691d8878460352ef60680e718457e1276486d025a4b21745e03a425e63e4e64434dd34ed6c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33d5dcb8319cb205ec6976224b8decd9

SHA1
249f44ccdcd7d900a1b31199589bc50ece0503fa

SHA256
c77c04aa89ffb1b552c43a3c1e7a7a88ea90b3c9a5be87e27c7181036645be1a

SHA512
37bbcb5209cd0357575e6d4474a071bfaba80f9e044dfd202b7c2d28a411bb44c818418a874a88a62f464cddf3ae136f0078c26cfc043c50645812ed4e98632a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
64a5d224bada2187302a0844ad224540

SHA1
f1ecc7b1e41cbee563eb81c8d224db695899d5ef

SHA256
92a3e35ba593d98e00d541fca4ee1d4ec6fd2f4a13de99cb1634a30a3494add5

SHA512
cc64f2af1dde6aed500ee9932395f67da1a08df82fa29666ff229feee94d5631329e5d65770d6c4c86c24fec2c59b577e63320497f4e142689073b6aa2ddcdf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0f7aac3f10949f7a710fa22610d99bde

SHA1
3e3cd0cc11265b7e284306e4dfff142fce749f71

SHA256
0e24b48480be7cabe619ad906a51dfd8a4d8af5c0b51f3f3ddc6fb203f4177d4

SHA512
334557cebba1ee9552f21f103027865b6cd6376d669da0c66e1bd34779b6fb57bd6caaed49963655dd823cdc2f9418b29cd572396cd9e1b253b783241829da17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dea5817d098608143296662d515d2114

SHA1
7a2665e9e57b308600c1ce653431c2436eb3f7ce

SHA256
cef45020319df1a09fa19dc523f8c1877b3765631519433965f8e0afa185fb11

SHA512
3081dc61ebe8d2d442573492057f724b455277b68d8bd892f45d03d97ef81dcf09183e733e69f897436025d14372f1148ce3c970f7f189e03de9498e3ab42164

Download Submit