9f66b035ecc3c150c461c999574a22911aa3fa2c5db6318426026d1a83711a98

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46179ebcfac9352f3d0170666ccd659d_JaffaCakes118.html
Size

175KB
MD5

46179ebcfac9352f3d0170666ccd659d
SHA1

0f4e7eb3c298281508597b4ab0f84b7f5ec7473c
SHA256

9f66b035ecc3c150c461c999574a22911aa3fa2c5db6318426026d1a83711a98
SHA512

d0d0ee7f99d6214d626686431dc4aec5df5d1b20431aa8bf35ef1af4a86742bc020b56aa98303ab892a24fa36ec5bf5e8fcf2b22034c8ba7000ecc4f37d3b5a4
SSDEEP

1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS3FGNkFKYfBCJisR+aeTH+WK/Lf1/hmnVSV:SOoT3F/FLBCJidm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
4436	msedge.exe
4436	msedge.exe
2192	identity_helper.exe
2192	identity_helper.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2884	4436	msedge.exe	85
PID 4436 wrote to memory of 2884	4436	msedge.exe	85
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3236	4436	msedge.exe	87
PID 4436 wrote to memory of 3008	4436	msedge.exe	88
PID 4436 wrote to memory of 3008	4436	msedge.exe	88
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89
PID 4436 wrote to memory of 1584	4436	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\46179ebcfac9352f3d0170666ccd659d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0ddf46f8,0x7ffc0ddf4708,0x7ffc0ddf4718
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1243272108178667299,6358680624448472992,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\104f3648-0869-449c-92c0-b57fe6defeac.tmp

Filesize
11KB

MD5
773b509875133d9c9cc56fb5e424248b

SHA1
b6a949bc103dcc9994e9ab50f32bd01f5ada68ee

SHA256
224265197abe1d294dbc241a3864f1b6f214ac69a21cf9006f4f3385d2348f3d

SHA512
43ab3e62f636997639f37965928f20d2ccaec6ee457999029ff441f48486ff7f42bb9b1071cb8faf436a05419a3f3284057fa3d0a14f50df92bd79b1ddbfe2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
8aa53f8671d35afd0f7c8f5384d76e2c

SHA1
6a2782361ed6208d011db3fb26d442b3c05275c2

SHA256
418eb0ab71d5ae463bf6221c9376f35732b229c99384262f0f58e6db60cbe953

SHA512
640978dd36b0c5695c1ee68e50d813151eef53177b329a18a3738ea939127c167247ed5c524d73242a5445077405a2e0d2e7d0855039f7ba314c03e5c5e1a037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9c082912db021d2a02ce9af0710bdcae

SHA1
984e8bb150d83c206f0d5521363c79a2fe3f5a75

SHA256
a6dab9264ca969b457c0702afa7920878041574f19401796bb09fb18adf73624

SHA512
0cfcc1477da4990d198ff913433db869ca8053668a52c92223194434896adb629b11a979053517b47ad556eadaf8b1d4c6514e93d00b49317226b03cfdd1cd7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e726bcdc51094b34bc2433a997cae878

SHA1
cc5d674a67f2e7f41bead25598416838c5300950

SHA256
b484053ffe94987e3208e7c92b1cda652ab1599da1d15e39f5850de8a2b36ed2

SHA512
c894fa7ef57f4fb574ad91bcc49229e6e6bfb7dd45c7b4f7a05d2f453a43e0519de1be197554878387ac6b5f8512daa69125508c1a208d6a871101a01c1bc05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da44c2f75dd4d6db50256004a768cc99

SHA1
0d7b3e4b662cf1ed3265a5eb752c9ee1897d90f0

SHA256
29b96e00a266a317a8d276a737af84204bec87087e01e1705b5b7ee05ba3d3cf

SHA512
c655b4b1aa22504358fbe674817325ae7a8db550048312e6deb7fce946da9ddb2c523e41efd3efd85f4fd8b47f6aa26b585f0e56edbeb76532b0cecd601d2f50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bcf73d2859b08e10c440e82a9ed472d3

SHA1
8a3b49570baccefc0d8e807312d99751b1362f23

SHA256
cee94da25a7c0285c48af8ed090ec591629dec79a8b39a944fff7a400ebf9c14

SHA512
149d3dfd0a25993ea958604c0e7116d60c879fbb71ba5952004943c3941a5bc292faad4253b7d19941366dbd8725663b2a2a1d5ad770f3c9044cc6aed841bf14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit