dd4402532dc5824e26abfe7bbbe88b12a4a0ce54a452362348f1da2ad701987c

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

111a0837bdf653cf1b9919e51da6770f_JaffaCakes118.html
Size

225KB
MD5

111a0837bdf653cf1b9919e51da6770f
SHA1

c4c22d9cf942a72e26dfae7288b501736e0f60f0
SHA256

dd4402532dc5824e26abfe7bbbe88b12a4a0ce54a452362348f1da2ad701987c
SHA512

19e5909e4aab448f3fdc25938a161ed4a1541a84413ae3c6e1ada43f9914b95d05f544a9541182bc9d19669f2bccc1810810f855efab2dba35f5afbb35d1a116
SSDEEP

3072:lTbGtREQHqiRvw4AwwPdHhdAFy6bo+N5FfXaD5hgaeVo3fkGylDCv5C+zMom/B0R:9qtfqiRvw4yBdAFy6JFfXaD5hgaeVz7A

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
128	drive.google.com
129	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4676	msedge.exe
4676	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4440	4676	msedge.exe	83
PID 4676 wrote to memory of 4440	4676	msedge.exe	83
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 3448	4676	msedge.exe	84
PID 4676 wrote to memory of 4236	4676	msedge.exe	85
PID 4676 wrote to memory of 4236	4676	msedge.exe	85
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86
PID 4676 wrote to memory of 2164	4676	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\111a0837bdf653cf1b9919e51da6770f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdbec46f8,0x7ffcdbec4708,0x7ffcdbec4718
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11941021210314834349,7960514711695597223,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
06c5d8a3042b4b342dd146322a7bbb7b

SHA1
d434c5b5a334fdc7bd9f6e3029bc15adfdf4fa45

SHA256
2ff30da88bb5c879b9bce40cf3ce5877e8f0da00fbbf75202f64274df19349e0

SHA512
5b5313af979ec28e6b555040518ae1a8e2e99ec488382065876d06bf5caaf21cb0f0fc485dbc764c5fb24b24ebb604e64c4c995571fdcec4ee5e2ac4a9d3d533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d2a294e22f5d157ec7bdcdcfd046a311

SHA1
f775a0754df5cfbbe91c2defbec4c1bdf78f6ea6

SHA256
95e7033cf80b904ed376c358e0b4c0b37f5c802aec040e975a1059950cda83e9

SHA512
bedb709a3c1182888c324ff38f0737d096b8abfaa11beab8682630cc86463671c0253c65776dca87d119db68f546b6f8d2dc750965499617fb443c77fb7f8d64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1a8f3dc5909507daab27198968504a15

SHA1
0cd8a825faf23bccc2f5db50636be25d75b2104a

SHA256
9ab9afbeaaf5a4f35edc046efd611141defa06352fc61c7adf3125e3f7bc010f

SHA512
489fafda3876160b3706d0a14e565d11c043120b3c294fda9c3686ce8f503f162ffaa90d3f5a8f33e11b6436d59ab59bba08479ed179b7f3148d6127ddb7b431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ec442b66f0a062640cb9f400a9cc651a

SHA1
d856266176aaf2e4f9113c9213ed148f73fc081f

SHA256
980160d9f38e14001bb79d19403b3797869b490c71ca111e382ef898b8a67957

SHA512
be04b7d49ce73a5e0ef6fbcff6418322e89042d17e90000316776fe6d806ceaf5527d0c3c158464bd476e672084ab2568fb2ff26f773b0e41d3fd79ba972e273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a5943ee18a8fa5175d6eb42c17cdffb0

SHA1
11b1fd0bc5b86a1b9a4a6baf38f903ed063d2bb2

SHA256
59b2012ad70e926a19850bf79941597204e591ded615fdd15e891372458f560a

SHA512
e8fac80b30d3d4916c058068cb0537e6f012f563fb66345e80cf111555977ec315af5b051c128fd477e56bb564f37f74c4ed89e1a34f1dcda5337416a19fde1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e85a31aeb9ba5a93f24e13518be4ab63

SHA1
b16c305b42071aa1121a6f75403e597403297cd1

SHA256
f4d1a2998c7852db68fe606c7bfd401ce46f38d2f3f98ce2cbe04917e1aa0f5a

SHA512
fecb86ccf07014dc0d46c58830fcbfb1d9f6c4490c3143f3f54455c94df71d699baaf2efcb3b3b91834840feff8dbd29baed04207c0145612fb62aff8fd8c67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d43a27ad5939b51b518023bf796a720

SHA1
9d0c07c84090852bddefc9d5960d2655ae38d1b8

SHA256
af89caf2ecae8bca81fc919d0c2cea64b6e3fabab01e9e814627f49c49124392

SHA512
0a97227a738ba6a1597da633e64229aab266f880dea61e3ea7ba18512d995fc7f60ba8f112a075728307a72518bb33456bde37bb2a41be8bfa27a1afcf90b8ea

Download Submit