585aed9268a4dadfa212bafc0f60b3b4d7e0b534f0813d694f2f156d043b9734

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43c6bcc3862928c3417cf75b34513da4_JaffaCakes118.html
Size

38KB
MD5

43c6bcc3862928c3417cf75b34513da4
SHA1

c89cab0e074ce6b1ebbffd06b9636dfc76c8e67d
SHA256

585aed9268a4dadfa212bafc0f60b3b4d7e0b534f0813d694f2f156d043b9734
SHA512

5800149a9dfd7b291b81545f721870ec2130c051ecc644e569f2e5425eec48fb153abab00ae60c0584c80f481d68377f68556c091e63529dd5534c95de8736ec
SSDEEP

768:SNB0UXkCTUI3otrFvbd/4WwH6RAJDLRqXc0nC3kRJ8wk6HA24Q:SNB0UXk5rxvbt4WkK+DLRqXcMC3kRJ8K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
1016	msedge.exe
1016	msedge.exe
4064	identity_helper.exe
4064	identity_helper.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 3756	1016	msedge.exe	85
PID 1016 wrote to memory of 3756	1016	msedge.exe	85
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 1576	1016	msedge.exe	86
PID 1016 wrote to memory of 4680	1016	msedge.exe	87
PID 1016 wrote to memory of 4680	1016	msedge.exe	87
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88
PID 1016 wrote to memory of 628	1016	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\43c6bcc3862928c3417cf75b34513da4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9eb546f8,0x7ffd9eb54708,0x7ffd9eb54718
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5009647353780647686,14927554932648703232,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
19KB

MD5
4626dd2198e3a8d724fa9160d0e60062

SHA1
bb5c31745f3898b9fc6f41e730c95cb8b5eaece9

SHA256
b1316a6807a2d403909c179a51324a0d31cb8b3d808eaf991c685c34b6889693

SHA512
474567b529ade6a83363617fa94f81244a7dbd9ca07fa05616848fafe8e449c5313d59f0183054cab7f4323bf55663f7f6182c0b5c6c921b9454d762db492182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
1302d5864f61e26b5e3b0eb677ede578

SHA1
9ddce0f5cae3956b6c3f43516cb27db366943bdc

SHA256
cf52e615a314ca4c098acb2c6edf5947bbad60614e2474b8d18a1736cc3a25f1

SHA512
cc9736e02fab5370ef20a44f06d43ba72063574c13c86438e5ffe510730d75368a3a85492d993719eb1080bb736cc1533a41c5e2f579a404c8a85e4a7658b94b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4843458115d913a1b525424613f970da

SHA1
a9ac1d08a9bf76c185c4392f4ffc4fd956c46c01

SHA256
b7d34aad71084f7c578cd51b7698a2d33ec6c4a1d8c374597fb1816b516053c2

SHA512
d2aa162807998cb861eb56e7f9b28b1d481b155c4260fe3c523c205050e8c8b1db8b9163a45dcde826e63111eb2dad64cd264d3b690b6931e52e46290fba484d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
22c71e5ba26845606ec9d963bcb591df

SHA1
c960ce7527125c066b45ceae45f1551d3244dbad

SHA256
3d82d7939e5f86e90aca999f85ea0fb8e25b38f4baf383f96136ef6534e73aac

SHA512
9b2e21ea185031c1fbe1c4650eaf8bb809dffc31d8fce1d176b3497b66cd6e10f85df905f1813b72d13a922883b30de64ab45a5c9373661b4272e449a405dd86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29e2514e4bcaf93f5a794e97367bf060

SHA1
13abbab9c7c4f0bd3c2b51d2b5c416ca94fc87fa

SHA256
e5e875a9dc5401e2495bfa1fe794c947cafc616c4451ec14fb9162fed1c7f092

SHA512
32ab0ec8fb8ce2a628fab325b0361feffa0be86e5f31eb72b6f7ace37f67951e5d0af014837bb520a8992c3121db410869e889fba94dac0f2782fddebd49b224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
785f53a2251914455d42ff7f459a8f9c

SHA1
ebe7edd226848bc20f75238a2ba45c52274e22bb

SHA256
55461045b1d75edc36ae02209622ab4d20862ba00ebfe56d598bb8047acf38ec

SHA512
3901499f09d7d63cb99bd77773d6cb5f47499f7f19872101f90c0dc8f6d4284b3310dad53f425ee8e3e8ae73dbdb2170c94338cf4e26f058f9152d7a75161e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad5f29e9840102121c67d66919242a89

SHA1
069fbb839b64b40f8c2345157bbb952f8ec632e8

SHA256
3b5b9bfb3724b3eee9dc6eb2475dd87e676ef22c2025f4db2aaff7b536235004

SHA512
53d39b068836e4427cc91d264d5dd1601c91a88f8c968119c56fe82019c3c1801e3c8f592769655a9e61530c98ca81133836db9cf1f1d5db5be39c1326b3b848

Download Submit