3dfc5e8c9f33842f9f504b57a56c993408b5c861be738f5429f9cdb2b7207ae5

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

162c94a013fdb7dbe598e38248aa3f72_JaffaCakes118.html
Size

175KB
MD5

162c94a013fdb7dbe598e38248aa3f72
SHA1

2b5229ecc5e98d29f3c02d1cf4421da7e0fbbe0d
SHA256

3dfc5e8c9f33842f9f504b57a56c993408b5c861be738f5429f9cdb2b7207ae5
SHA512

6a10691a23c81016882f4fd160ed5eed678c7f78e9088fe360958fbbca385d35811b74ca8a0e7ad6387113d1aae9e12ce664dd2544db057faa831ef7ef3268e2
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3XGNkFVYfBCJisd0+aeTH+WK/Lf1/hmnV+:SOoT3X/FABCJiEm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
2364	msedge.exe
2364	msedge.exe
2648	identity_helper.exe
2648	identity_helper.exe
5264	msedge.exe
5264	msedge.exe
5264	msedge.exe
5264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1244	2364	msedge.exe	83
PID 2364 wrote to memory of 1244	2364	msedge.exe	83
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 3628	2364	msedge.exe	84
PID 2364 wrote to memory of 4716	2364	msedge.exe	85
PID 2364 wrote to memory of 4716	2364	msedge.exe	85
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86
PID 2364 wrote to memory of 408	2364	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\162c94a013fdb7dbe598e38248aa3f72_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed93d46f8,0x7ffed93d4708,0x7ffed93d4718
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5820785115068933748,18318657989477112048,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
8665961bfe31f48420864a80e1697ae3

SHA1
c6482bede6833ac175ea0f8ddb83364bb63eb660

SHA256
8f96b648e5c116412507fc78f63a2db67f1b11602d897b753285d3db69de555b

SHA512
1db6258e4a5b1b8dc6676ed0bf597220606976b9d309b9d3785d48f0a7b7c62e72fc8fc6a0d0b911b23440ba2faa4c0ab45a19635c0b45a4ae578e8d7d513df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
a517534165035dae0a506008ce37ee66

SHA1
7c9e8353e64248d215f620748b55dc31a21d4f6a

SHA256
6f345bb77ab50e654be2de3fbcf5deedeafd115f608d766346e524b95159efb5

SHA512
e3ff7691032c1fcb9fc4d0c3c5b7a7147417d379763d12ea2e988de379658814a26327884916d24b3b1ec9b49b014bf0636f5bf880db69c0b4e5734beefb7dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0d64a33c3c71007574adcfd344dc8452

SHA1
c06664242e9c44a0a957d60c0761b412cccc41da

SHA256
0eddfcdede9488566f45ce28935f4d28a8a9f200498f1912e0a5b8672eb58c47

SHA512
9583ae309ec3b799274af32ebe7b664d67ca8888eb746275d597a9fcfc780a9e454347357fb92d4bebb7015542b0a46936ef8371e8038432e7073c8cf14807e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
429436f80752531bdf74322095ec44e7

SHA1
1c67fce99f84f4915cebb61980a6f02dd098d61b

SHA256
e9d000ea87206790d14053d1950a9b85e5c290f0b1d17cef18653697be14f85e

SHA512
6d6fd3456f32ea03ebdb70be5520504ee55622f05e7cce7e9fdbf50cd6a68433843d2009b093ea8c8766c55c599d59a9e5e280fa93516a9970b65e91ba37ee22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dee7e34d59e1c043fb9304058bd0d578

SHA1
1e29b5538127dc80bee007dc163b9ba50117b05f

SHA256
65907421f2b4bd6d6ac9a49bad662b838e4e2ea145df9739bf54e79c81a52927

SHA512
7de6583c62ca9c32b03d77e919bf41860eb6518bd0dd647fd0df42ccc207f2bfd6094e968455bb929ec4d9993f9ee18a2460d21429051fdb5a718806de433f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
db1cce7f178bca23b365c75b9cdabd26

SHA1
71f4e6537a84ef3dec37e0f354a7bb06430e48c5

SHA256
9e01da863e4960020af50e4a85b9528484f91f17444d82f9c4b8717206bd229b

SHA512
caa6f5765d0233dd0720e8669a5b3701d13fed392b13b3b5b706b8df4d4795964b5b9c5eadd03f9dfee55baaa71aab1fbb6057bb78e1f96f28fcbe33d782d733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98f2bfd63ae99a0118062fdad225c7dc

SHA1
de8ad5094fd44c0a563a84efda5a244bf50720e2

SHA256
8a5dbf2676ab03cdb934f7c94c4037801cbf5b374043b564f54b6fe0cf060ad4

SHA512
4f8aca3b3d90f0086b1b342cac3dc296ec1ea6299f401ab759a184244457f2bc92f5c95f145d8925515c3d54a466cfdde19d8911c7448b9dcc4d32745cca69c3

Download Submit