d7d0a18457119074330807340fe8fdf2c093e957b2b88c0edd2d4e0e53742862

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cdbbc30b98928838aceb8a66ae670b0_JaffaCakes118.html
Size

34KB
MD5

3cdbbc30b98928838aceb8a66ae670b0
SHA1

b4690d0efb1ad083c00a43e434b626258c110b77
SHA256

d7d0a18457119074330807340fe8fdf2c093e957b2b88c0edd2d4e0e53742862
SHA512

2a05ae3ee73af4b8bb730c0dee0dd7f47b7bf4b93e2ac1de93051b88f597ea594f17e99d982e83c5fa63e3ee5d9c75cdd7ca2649a7b3f659311aeef01c9a5caf
SSDEEP

768:gi/vm8MoT9KYK9WAFRFeWWAHJKJKZjKpP0KAWT/Ru:gi/O9A9KYK9WAF/eIHJKJKZjKpP0KAWA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
4512	msedge.exe
4512	msedge.exe
228	identity_helper.exe
228	identity_helper.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3884	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3884	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2180	4512	msedge.exe	83
PID 4512 wrote to memory of 2180	4512	msedge.exe	83
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 5064	4512	msedge.exe	84
PID 4512 wrote to memory of 3612	4512	msedge.exe	85
PID 4512 wrote to memory of 3612	4512	msedge.exe	85
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86
PID 4512 wrote to memory of 3004	4512	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3cdbbc30b98928838aceb8a66ae670b0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe413d46f8,0x7ffe413d4708,0x7ffe413d4718
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3414166026686036147,2290497119322157267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x248 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
8be345c5da8984b6a0fa154fe05ef19a

SHA1
6b27bdace77fa6a281414c5c730f232109aadd04

SHA256
b1f24a047d23ac70b62c49126ab2b026f48e99ea11103667495ca769cdf4c5f3

SHA512
4eb5c4a53c62d6a5bf098f11e0ddafaf77dff81188e9647247c0b21edc84c1853c853cf89f41f025652f0db380ccf5b2922cc38a3059ab2e27070a0e279907c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
d88afafc0d7c248c5eb9840021f980aa

SHA1
51c1c84f8910f0b2fb527445e1b08b69c8290251

SHA256
7065adc0f5f74ee253ffc3f11fa1bab78aa4cd96c2c15d0f77703c37adf7d897

SHA512
96797fa26403189f5580f287b77149838d40a0f6b541961599f0e7aacacfa7665997bee6003784fe697564871a11f3b08681af831e3df0d520d0f5b7bead0c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
86553d84b5d6de4158baac1559698dc9

SHA1
44512bb350028da3f602d43570be8b1279a06788

SHA256
3428859d84729f48d8b2443d29c5345939e2f496b1f4e2dc20c6fd428ad8b33c

SHA512
f1e4b12c68a7bd67a6cf47c19299d90216c84408f9a6db0355f33ab571ce54da111578d9ce0872d72a50359bd078b7ec2f483892c707e4e956add9a84f88d83b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4cff9ed264f925a35741757706859079

SHA1
f71c6bd386ac6dcf60e1d9a2ce87bb3cfb5da06c

SHA256
65b9ebe74694fef6fcf451991bbd06f959fdfa3ab366f218bd315c9471a65d69

SHA512
b44df9296f0fe26556bb651b3b45a41c28717ff4acc07305ef71cc8ab41e10ecbcaaf65d9d693542282f91295529c9350af9b130756c45031d196428dd302bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3bdfe84abf221fbe53dfe09150811c06

SHA1
c464806108dfd578bf50cc3321e129d1549f68b7

SHA256
7562116f95fc4a1f8d8c361c94cbc2cd8717723c926b816340890277bbd449e4

SHA512
6e87d07efa213037288878ca25d9e624390cc19b8ae4bf20a591ba6e53aa992e07fe71d7306b433deef9d5d20028eec52459b47c1f2669857bcd42f265e9a20e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6a071174f69110f8ab847996727b285

SHA1
1545cb90ff900b80e363ee0c4384c43beca0aacd

SHA256
5bb933d1cdf8aeb6c6294785ffa8add39fd055144822e82ea222a44ba5babff0

SHA512
b51581a047d4a825bfedc9a1b921cd7146f16496acb863b0731f9198d2748ee55b27d464c1ff3c755ea8aa7334350ae130ac88017052cecce1401e61d58a64b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97708542b33d38137af1186e8ce03bd1

SHA1
0e102e3e79675681a9709b39cedaca4ce20f27c9

SHA256
b8ee0e3302c6c53d3606862e8050ad161fc4c17a014449c8e96539212ac0dcb8

SHA512
67e9915f815cf9ebbdc36a2ed389306be7947c4e3ab8694bb53dbeb0bf5d837a37184d0a6e51f2bcc0569b7c7242d5ab1b951c1d31874deb3b46b25a083bdef8

Download Submit