274f3a03d533354338996c88e8b9367c411905d8496c6410362c836595384eb3

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3027c30f1abd6ef9e848b96c751665c3_JaffaCakes118.html
Size

46KB
MD5

3027c30f1abd6ef9e848b96c751665c3
SHA1

c32d39827da9f43747e00d63918d676d22638d35
SHA256

274f3a03d533354338996c88e8b9367c411905d8496c6410362c836595384eb3
SHA512

454a0c032a412914589e6dc6147c313cbba6da923b9d009d6a2c000ab48bc0fa90fd086b4e11762e6e6b0cb26d76e152f9c94b1102dac079604cfee84e60879d
SSDEEP

768:JwpdEj1DelHnwYijE8nukehxhFstm0qvBJdn63jtmVctwPYXNpZ29SY8yf:JwpmjJelQYijEWukehAuvBJdbctwPYXs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
5012	msedge.exe
5012	msedge.exe
4200	identity_helper.exe
4200	identity_helper.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1480	5012	msedge.exe	84
PID 5012 wrote to memory of 1480	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 2560	5012	msedge.exe	85
PID 5012 wrote to memory of 3376	5012	msedge.exe	86
PID 5012 wrote to memory of 3376	5012	msedge.exe	86
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87
PID 5012 wrote to memory of 684	5012	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3027c30f1abd6ef9e848b96c751665c3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa797e46f8,0x7ffa797e4708,0x7ffa797e4718
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,4105817894140316878,13962634567606524134,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
3e1374b09f67f74663b5aa9fadfc1b6d

SHA1
5730ae1f0f41034a88a4f1791bdf3726d1880214

SHA256
3a3bff9c82560e0115ef1bd3d026978ac8a9284ea6b7331e5704bcf7e7cc8608

SHA512
5d8c22d3a861e6336a3456eeb06c6fc03433967045e50a9ea40a63eeda41734a951f34d462eb57dfb6ec284c56a1d241426ed3838aacf1eb5eb866f8d704c728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
6e54c0b8d75364f2b07830b9a0ae9589

SHA1
ac22b9aa7a5e0dc8f78002b96ffb1fdf6477d882

SHA256
fd779adf4217dd76451f63e48475dca1bf4d8d86168dfd763465c7fc53a1aa90

SHA512
c6e75b16b5dace0ed2ae299b5a87d084ab7b13da1d4a88a98446705591662d3b155787bd02d9d4c70c506a12ca3dcf300acbe7c7d949f98f2f4a21f253851ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c56f6d473716493a3b09193c62749b39

SHA1
ce5991281be1f9431a21e4124dab1693902a10e7

SHA256
270e735efdee7571e407174728a74c9f57f2b8063d4ec5122af9c8fc58343ed2

SHA512
a39702d7b785434a4eca7d2d47190d53b7f3efc5c65f834d1fcfa93bb8c465a063ccf05182c36ff02ae3b2c72408917c894116f8ffe5cd4fe74d61c5f49d16de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1c1397cc9e0aea40d4a54e017a3a38c6

SHA1
0945bb453b56dde45ef1b763b11108eb9a538809

SHA256
67ebed5ed648147294c439034b50aad10a3cf0009e19b2dc4546783b765728f4

SHA512
7497771f21e3c3cd7605cb77884c891b3060827e4864e320bfe2da72726db4a7063af58793c5cde1318a8c52bc4b0e70c1ac8bbaa968f171888a307769d0ed4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c96977c09ee5e00565774b60ca5dfdc3

SHA1
a25eb7c9e2996e36f0564c8c339dbdf8195bf4e0

SHA256
055bab874fb5c7847fe45259c90eab44b2fdf83399fe0bea996911cf536e7314

SHA512
d8ccd81f38f2c990f21b03c7504d0c0b9362b9a09aeb5f3b44fa595c6dc2be7018c21a0a462b2763404d6ec26b7c25b21341d634f1957a67b5ac7763da8baf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2c5c9f23280234bf8c4343b35d1743a

SHA1
fde13848bf0d40bdce199bf0c2877559061df8dd

SHA256
44cf2340a398793f630c9894f2c05de41e766e9a875fc732978bd4f47319b487

SHA512
cc80c98f7d157d6d0c93d21dc77807b8b194f19e4c8512495041d2d14935ccfcfab3982ee31aee79f50aa27231c2f26164b783f96900883308fd3292e66b17b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0274bd9601060ce55db4d29766d027b9

SHA1
1f583af78ca803919527ef5bdf84e68fb0f8cdd3

SHA256
ea64d42ae8076791560f5b9754909ea761b28d2760d2042f6436bf3e49f35195

SHA512
bffd489996623fc4a1ea79920a8c1427aeed597cc874f674b701083cfb9673ab42275ad5ba3fb4fafcca88cba0c4a24bb3e0ba1b5ce7cdb9e4562437dcb9e33c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
967a4225bcbcc4604b010cc8f9a0d665

SHA1
5de12c6805141abed5818e86a0d2d2c07cf1f4fc

SHA256
46ffce5fc40bc7e0aec1673fb831e07e4f58c44c1c1b2dad3e3b350241c8761a

SHA512
b751c7f17429ba56da90f6f6d5e4371b622402c7cd45d6fa79dcbaf056883607b9534784c73cdc3b5def39c7c923a120a84c004d6d1bbebf4c408a02180bd6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d48ca0008fb7a73b9fa3ad6487a16e9a

SHA1
fae0694806bae5c007a7ba36d24cf3ae0014b77e

SHA256
86e7f125cf06888f11d1faf80f05977bc56fa6ba91084787975c501d59ba7010

SHA512
daed198cea0128cd1b9a32c83be4fa59f199c075409ac468791115ad557648692bed543d497ad5f3c104c0d0877e68dc99f62cb94b31247471d5a56d9195c6d9

Download Submit