d0e8e4df46adff83a3a40e351063072fa86290f05b021bd5ce68923f766181f0

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14e1a957c0b68168b5adc929b7a4b5ab_JaffaCakes118.html
Size

44KB
MD5

14e1a957c0b68168b5adc929b7a4b5ab
SHA1

1a20e148bfa72a5d5eb2d25a395838d25f9e97c2
SHA256

d0e8e4df46adff83a3a40e351063072fa86290f05b021bd5ce68923f766181f0
SHA512

08c34b27e5818f448143721e73d4e8c384b8b7bf04869c5ba4507ca6343c9c168f09f7cc3eb228e0cea55d6c4270a79ce0290edaa70281c5f0130712cc28d702
SSDEEP

384:xxTDd7vfWbJKuMKyryfg4ctzrs3SOVDAuVe5uVIcHuV+QJaNuVAhhuVis4uVgNfc:zpsJKRofg4ct8Q+R8XZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
1344	msedge.exe
1344	msedge.exe
3932	identity_helper.exe
3932	identity_helper.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1664	1344	msedge.exe	85
PID 1344 wrote to memory of 1664	1344	msedge.exe	85
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4628	1344	msedge.exe	86
PID 1344 wrote to memory of 4860	1344	msedge.exe	87
PID 1344 wrote to memory of 4860	1344	msedge.exe	87
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88
PID 1344 wrote to memory of 868	1344	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\14e1a957c0b68168b5adc929b7a4b5ab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa5c546f8,0x7ffaa5c54708,0x7ffaa5c54718
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,1352554113878085055,12841986066705999799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f879273-cd17-4323-a18b-bcb9073a7fe0.tmp

Filesize
7KB

MD5
40f897ae59afae52bc9c88906270f88a

SHA1
6e69c9eec67c8f72c237793a73e695e5b75fe891

SHA256
c7e329c198d7228e35ea10632e298e227737cb906e820bfb43314053eb9f0d5c

SHA512
9a4e10717ae1f5635c9e4630167ac97cf8d0ffc29a85994ce76dc0a6788da1f5f3b384a9eb34e512d7bf2ccf808082d350fd7720696cbee6c3e13603205a3a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
cc2961a04f5611b9d5626719e619b50b

SHA1
f6fb3f5698dc3167e30a9935ee9ccac7ba61e48d

SHA256
a6dfad32d7272e6de8c556d65a165f9879e14257575e9312eb1e146b64fd0296

SHA512
5efeaa8d8baaae213590aaa974c0e77fae4c53552db1e58afae0a82de23b9bf830fe20211c53c41341fbe1e9b25bde4916ad10dbe7d1ef4f2e4949c169cf4225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
dc2872d3732caeae6f481e91a7a78054

SHA1
52b26d59c54fbf6f7cbcfc62f1c6eaa5effeaa57

SHA256
f33e3a9b3cc5285c586c801162d491ed3e2d89b4ba4406da0145bceeb21afd97

SHA512
177830061be5a6eba33ea3d0a4e17fb586d542a346c9878129649406f1e967711fe11e766e6cea9d2daf944b6c8028dc1889b382541014d9097f7da0506b797c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c21599cbf4d87f867d97b275934260ce

SHA1
f72b088cfe21d8bd4ca0f0789ef9533d022d23fa

SHA256
30c8bac159e18520bc19d7c824f8b4df0ab87b8a261702ae1e70d2a097493a98

SHA512
5139920e365cd933a40484160d02526e00dfe4261f76a4f26229ad705128e6146315f6f16ee060409ed4e1379399b1d999933544ce52a228a5e2a3a7867ae581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0dd39f9c7064ad8dbf3cf3720bcb4dc7

SHA1
f3a9c7855c228b56c180eac748af4f327922d841

SHA256
f9b046d83a277a696b404e16b82065355ccf9543bc68671decf05c23555c8969

SHA512
e672f8104d3d99285fc872e2b00c31650d25fc24bd4d3531b1e6c58950c74c524c8816ac942b6467c34818d5fd4bb7396236dee12bfe494c2777f00aca0df06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2d3f18d9920986e13b06cd89b196293

SHA1
552c8ceb89b4b584add99830c3dc6e0ebdcd639c

SHA256
9d6cb43d23fbb1472abd75844c46c0f06aeea4c4c6008c89cc746949640ee381

SHA512
3e5df48473688022536748ead4e6582fe3a41b71fdd67cf1c104f3479f31e0a134304f6be18731c4b36a08762703d529ce36fe8e8b3a0bac7de7698bf43550ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
188ee871a57c1c2258f448521c0593ed

SHA1
87da5616326f76493b71d2a4933fae02699c40d9

SHA256
7661ac4ce0da4c078124bfa752c0a9f40975a4baf0453474fc28ac527c4f6217

SHA512
9005cb7a2be3bbc7d19624b52260667548d4a3209dce2476d34cb8d3de12204bfa791909e852804d6b63088298d9e5bc6e9e88713a726eaf9499a48f8ecc234b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d399a10a-97c1-428f-a296-8eb66dc47e45.tmp

Filesize
11KB

MD5
eb1f90f2b7df0474e6c2aff09b2eb3eb

SHA1
2cf7050ae280acdd860499fc0e7dc064389e8feb

SHA256
a34a2465348fec80bd12cb080709cb1fc0bebf8dd18b4d1adf412f465787372d

SHA512
5a1b23b10612ab4e20d348bedeb9b2fa0652485ab558e89af9c8a9e126c0131c585f827efda590616cffc404c3a2e9ae77b009d8c5a81a9ab01d649842c5ce5c

Download Submit