92e30de73c48f393eebcc21dd35229288cd9a41fc262c575289a1b5ba9764b95

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40bf8208f781c12cf81ffbd4d5c486ef_JaffaCakes118.html
Size

54KB
MD5

40bf8208f781c12cf81ffbd4d5c486ef
SHA1

16b360df65e88ad8eccf6850e1a393f294555a46
SHA256

92e30de73c48f393eebcc21dd35229288cd9a41fc262c575289a1b5ba9764b95
SHA512

28fc819530844cd0d90d76929f0f1320b4e920c67a39d5287753a0e73706989b4d9ac3e43af159d3e9f573c540148c8e9914ec61c20cc406020fc6b05f882a55
SSDEEP

768:F5RR3ErzpHvvCIoxlvjLVE9QbEqPtQO/qwtwq1nNtm5o5Wsj7cV:F589Hv7oxlVE9QbEqPtQOB1Ntm5ow67Q

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
3932	msedge.exe
3932	msedge.exe
2676	identity_helper.exe
2676	identity_helper.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3908	3932	msedge.exe	82
PID 3932 wrote to memory of 3908	3932	msedge.exe	82
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 712	3932	msedge.exe	83
PID 3932 wrote to memory of 2228	3932	msedge.exe	84
PID 3932 wrote to memory of 2228	3932	msedge.exe	84
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85
PID 3932 wrote to memory of 3660	3932	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\40bf8208f781c12cf81ffbd4d5c486ef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff86fc46f8,0x7fff86fc4708,0x7fff86fc4718
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,7605242436924832955,6194201453464236344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
df9085ec5eeb863401bce11f9bf1ceb6

SHA1
0727892e6eb1addf725c761e41bfc3307dafe4ea

SHA256
2b2f2a6d2214b99b03a602b6a8478515340526d54164b30b1348df5ef5ae7e88

SHA512
fc74469959ceed8f3c3c281e5bf9880daf16c125f955a2ff74b91355ac62423f15bbc9d66c828234e76af9f0205e702caf01d228d211194638ee9af47d023a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
28a7c5a718c22d8b7c527845dfd99aac

SHA1
a37be3766f49fefa6f64de3e8e8b403520dd5b4a

SHA256
551a42cc85167ba6b874a31b17b8f2a5a2e3c556ba00c7251ec127ecc24129cf

SHA512
84c7a8b0cc287c343e1e8b88f20f8acf4e08ef6e4b32e30166e3ea2730152ade75d6c7e0e64f6a0fd05e6cdf7bf10255208993aae93e0f5b6af37f8b9740f14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
52d74ebcf4a2b30bfeba3bbe96ace5cb

SHA1
1b03da63bc31f6c7bb189f86ef67d1c331fc5387

SHA256
4192c3769790ed56697de8c547f68e61273d3ee03f72c1c22e49607b5fef38f6

SHA512
7b1efe108ba21ab30f0e3dcfecd69a4b02182825fe60346b97b96f8fd2ccbfbcc035609160418f2865c32b0a1851d104fcc7d97a019ae8fa80d54ad1633ab6bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc0117b6711e7d5402787a6fa21e676a

SHA1
863eeda7c4e737c8e26be9c9de42ca1dac7f7bf7

SHA256
7480831ed0672c9b9f0b9470244eee754cfaac8e70ead85d46548987b8d9bca2

SHA512
706f8a9428d65f042ea833cbc59777af80da5eea67e71f599a7377b4de79f1cfb5cdac4cba854777ac5f484f7cf056f79f675718fc402e6019a3d55662bbbd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1dca991106b8a472470711521598e91c

SHA1
9ad0e8da50b27837aab61c2abec002085c5d4e37

SHA256
1bbfc1db8f56a904a4a5f52e3464b7015edc082fcf58a8f580a4465bd84b87c8

SHA512
3b38d1c27ded98b392da1e70864fc160b762915ef3a47892306fa8aa5bd97080d856718d61234627fe8894b37311350b7d53b499860415ffcdcfb2c0250e8f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f9607ca943a81bd49ebaa66f366acd82

SHA1
8809ed9d752d6c3c9f7e84c5a57edb349a8b0227

SHA256
11968c7fbd779b0b258fe36542adb5c73be6821db692ca36cb589dabe50cc6c5

SHA512
7c34bd867fc115f76e039fe64a63bdd13cce1caa4d56683e4316a2efdeb5077febad289785900aafe7bd8c9f4977bc44f3efa9a559e88dc4ff3916e7fe025d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5725b764ad2977ea3907a84664d6586e

SHA1
da3038bce985f49772069829f438bb482caa3157

SHA256
3dae7cb9ec357750ab9ae6197120f1162ae61c781c237ee32a2c9358f09cfd91

SHA512
4367da1a24214b02a45733fe858ba499dac98844aaaa4018fbdf2a32e56e1a30fc4f2720ba0c189db839cd3c7646d4830f2d68d5ba929b8a7470d6b9aecee66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1cd12dd19752044a591774965bd60b3a

SHA1
bd50d6cdb725975cdfe1e5c0067bbeb1f3084525

SHA256
8e52ad91d0b909e6f41f81fa62cb9f1d6d4c072bc6f74b38adf9aa1e45d0aafc

SHA512
95fbbba7890ea7add10cd9a0ff5a63499af4f645bd37bd7317ac793d77f6154e99d2cc19682d445f8491023bb1dc321ab48ccad73fd3d2e052458f685dbd4db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28b3a2efe545a80fc0069b1b43d7712d

SHA1
9bc394fb27eb8207a50707883d41ab626e4a49e0

SHA256
e4ee114c10d9ee2ab7643c8ebca2f26231f095350151d9d2807f29be5c5c6be0

SHA512
10070aaf39df86336caddde6fb1a1627e4c817edbe4faa62d13bbfc9fb600065d5d81f114c5af59438389edb7392c1f00d5b684f0393c0e15ef2d94690c008ce

Download Submit