9bc5bddb282e07443be7f89ed8f68cc7ba96516b53d237a26dbf4b736eab38df

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b4a673cbb784f976d7ec42fa6e72887_JaffaCakes118.html
Size

289KB
MD5

3b4a673cbb784f976d7ec42fa6e72887
SHA1

d5ed8eb53424b09b179d43242720367b830923b9
SHA256

9bc5bddb282e07443be7f89ed8f68cc7ba96516b53d237a26dbf4b736eab38df
SHA512

0d7f51f82f0d33d71034ff44304bb73635fb6ae2edffd071680485ef33eddfc786dd2f04f04fabf84e1d5ad42f04fe607243652d18ce7034ece5d136bc22db8b
SSDEEP

3072:7OHJu5q+lj1noUZwQrQqK3dgoRGoU78YrVy6Aj3vwYt48GDgvX7i+sXwEvp:iHJG0QrQH3dgoRGoUcj36DgvX7A

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1532	msedge.exe
1532	msedge.exe
2172	identity_helper.exe
2172	identity_helper.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 5096	1532	msedge.exe	82
PID 1532 wrote to memory of 5096	1532	msedge.exe	82
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 4496	1532	msedge.exe	83
PID 1532 wrote to memory of 1116	1532	msedge.exe	84
PID 1532 wrote to memory of 1116	1532	msedge.exe	84
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85
PID 1532 wrote to memory of 4636	1532	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b4a673cbb784f976d7ec42fa6e72887_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5eb246f8,0x7ffd5eb24708,0x7ffd5eb24718
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5398572284684015906,16956885244357870143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
fee8feefb4e82178157d64a51baef513

SHA1
d255f05695fc12ddd4ecf01ebaf031a7cb32b04d

SHA256
e9b443ddde409a892a156824bf3ac9d7563ab18155837eb6db74fedf4bb09bfd

SHA512
4e22a65e972559fe29c7a04fee68a1e7cf4284f60960c6a96c017c27c50c00340bc24c480fd8e395907b7ece6fc05561fe5816303e7abada484ee8e24625cbb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
56850fe2fe6bdaffbafb27b0e22978f9

SHA1
cbff3818430a2c0b5b75f9249abebb022b91d2bc

SHA256
f3b25e9d32a39ccd0ecceea6975801228392aaf40e023e105b8779099ecb06a8

SHA512
3663c8a939740e15cb98d61f8cbd18e16107fc2b2cddc18f84bfdfe6391c52428d51086e1ca440cfe5660664204f65a33c023371dcbe60fed9baf79329cbbdc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
103d7ef7220c84ef3aa7de3032e3346a

SHA1
25e44229d4893e53bae08912f8def2f16e998741

SHA256
a9e88c2c6979e162c21f24a89847cecf0151578c87337c57e03f48a22b32eff7

SHA512
cd435d79ee2f8425f7f6e564c5c9f20fd2061f1f76d0d958e104d2ea755f2bfe26fefba87750b706d2c8d3a9d35551dec362fa4be503bf27715b747b44778db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48a8dd8b664a7e9850c3ab76259d2afe

SHA1
e74faf034074a5b2e478ebd6c4152b982e66a24d

SHA256
18dfa248913246aeea588e9e738ab6a1ed9958016d4b43b96657f16e1eaa3c97

SHA512
35dd42d9d2d959163850ecfacca8af15eb55be3335b86686259fe260ffdca7bc8ee3b62a75b06e0f6b3b90f5e2566abf83c2aca06ac516e07d3a726198ad0e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d8f785c3f44b4d01d306cd8d1ed3765

SHA1
45dd6389bbae2cba4eeccadf45d4af39768ac7a1

SHA256
009144250313a4ae76e3b06198827ae7c1f7394b8fc780e7b3c798b3e27e176c

SHA512
d4f0c8ac29dd1f9d937d5a8b19ec92bd0e0850c696af13f1a6e8ce2051dad1dd77c767152a480866040a089fcb08ed53ee95bef57bdf8bd96d83023c920157b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9424d0ec94d3102c4b9bf8b222c3f0b6

SHA1
b977011c32ee2bd5f2be1045fdeb93582a9df636

SHA256
9c55c1f09f7ae43b1221e74cf59b92f7ebdb6e22e3fa3b62d78d3ffa300a21fc

SHA512
404febb1e708e702a380812599832419de2ea4806843627e16f68bb8f5c490d8b44c1c4838db9203974b480762f405a40282cd6b5755c8f4e3b00a10621bf12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0036e44def093f903e18feb70564fc8b

SHA1
c10248073ca95d9291f4134def781f1b519bd15b

SHA256
2bf3b933e9f87f2e0738185a914519b332cc03831352ec7f6f5029aac74fc3e5

SHA512
032765a8b9a5846d87e244c5c5fe98c1c799fa7e663c0c6e77110ba9f2b3d176637b8c88b13d6c79eacacc596adbf3405ea98b75dc644e6139898d40775b9ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2bd5a75c56fb8c4b8292b1b167ad7fd6

SHA1
76127fb28322b09dbe4f7f8c3c893cac86d6ca52

SHA256
3d2e8e6a61b8d8a9f86f9075ec2ecd8fc75570d9cceca7319710bc9ad7483353

SHA512
24c1f68de379b4199eae53b67c1804f33bb9e57b749b0147e1255ebfc0b57d5984f5018ff05d72de0e8e9d6bfc4439d763dc76058767d1b9366e553273d0f18c

Download Submit