caa4122485064368f34fbaffe537128085393c95e2186bcc2e351da8639afb37

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d8b59d7b938cfb410daaa0565b23f7b_JaffaCakes118.html
Size

57KB
MD5

4d8b59d7b938cfb410daaa0565b23f7b
SHA1

c4a7104f9e9d1b93a8c660acb5daa4b5804e0bf2
SHA256

caa4122485064368f34fbaffe537128085393c95e2186bcc2e351da8639afb37
SHA512

181e8f2856dc8ce6922c7e1f2238175ed316f5cde0dd3215c77a259d6526b6de69220be5bde5cf12cc9e4b4081643b0eae95b4709c2a1449df33df12b6374b12
SSDEEP

768:eyAc8zhdEPe7rVF4sgV0X0Hdke/6MDE3Bc1qpaDaq4aQyij7929Q3:B8zIiVBg7H6e/6MDE3B30Daq4lfN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
4852	msedge.exe
4852	msedge.exe
4680	identity_helper.exe
4680	identity_helper.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1472	4852	msedge.exe	82
PID 4852 wrote to memory of 1472	4852	msedge.exe	82
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 3012	4852	msedge.exe	83
PID 4852 wrote to memory of 1288	4852	msedge.exe	84
PID 4852 wrote to memory of 1288	4852	msedge.exe	84
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85
PID 4852 wrote to memory of 4280	4852	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4d8b59d7b938cfb410daaa0565b23f7b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7e2546f8,0x7ffd7e254708,0x7ffd7e254718
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4463667586945290359,18362297773397585017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
5f30fe58717933b74801a31f92f2b266

SHA1
487e17dfbb5a6b4d949b6cf8f0da67a8031f7696

SHA256
68c2441e7f424ecced4b88bf927faeabcbce8f09c696eee29c3a35a8a96af97c

SHA512
b772271e48f0461383de9f5a5f5dbda7791be0e55240324d48f3bf5131f99db3316caac4f91e899856d71473e282c8a8d7b979fc64f8167069bbc5558eea92da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
609e5b3b95118b393fa7dc12047da65c

SHA1
be5f95040249395608f3025a662f457bd9b50840

SHA256
621014dea01d7b93fe3e930fb0e0dac513f8b5f4f3d31ae27f098da00221f991

SHA512
e02c428f03af1d2945a30dbf9a9d0824b850da2b79ecd28f3a5dbc823a229cc73596f92465711b0e7eef6183a68fa2834226e77e727d36f845624610895b567e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4ce8771b5e4c717384e623a42759481d

SHA1
a4cb76af68a5c4c7b0a9b2f7ef0abc5d8e880bf9

SHA256
25e1053b733a1ce05ec4525889b5dcc2e9ac865fb1223ec260290fe251cfa80b

SHA512
d6dc7a240d16e93214d9a3546cf45a3bf2f72f8b5fefa432710b5335b770a190c768b8ef0f15560a5705b35edf0c3fea05a5b99020366d928557be1936b42608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d9e96448b4b47859b5e8b302234cdbe8

SHA1
3504fcdf42c0b5f63559e57756c9ca837893e1f0

SHA256
4b6f15e06f6eb8fd63aa8968739eab54d408fbfa8cf9455787b79630688f765f

SHA512
47befa74c4639b696e68eb830eac675b7f56fdbf9dc063959eb35706f0c9c968a219f40056bf761d3dc4c16400539e0b3d7aa0e63a824073e7cd8f97f96366e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a34c66f1be5011553aa6a5a0c88135ba

SHA1
41c16b6f954c9a06a9a5fdf644b772490aed1152

SHA256
a4c6827441a957e8de5fea5787bd8d6bb9e435e18a41c68c064f388d744acc88

SHA512
7d8b654f4ca46d9172bae95a7100408ed0811f19956c92024fb29af3b118a278109f981d5f734235725bcbf0845fece81b436a0762952146cf3b728a36969d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9be68201c15fc0f5f60e5fb2ab4c6f6a

SHA1
d8874294781ac6740ea80edea1155b056ff2a4e8

SHA256
379ac749010bca46849ee2545d5da5cb335a6e7f3d5c9e7e0e066e340464e2f5

SHA512
f03b6be1cd82ad416b0adfce6cb665aa5aa8ce6d1fccd6d334e27c2387a5ac861ff84a40a2a992a53e774c4b8faccccddee5d47634e360ad22532d6f87398adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4cf6451edce110700827b6c3721f5197

SHA1
7443f7a5eb3441d69173bc4e94e01b6dcdcb6d85

SHA256
bc5ab794feef776e525dbb177592a64e76f239a9254e129565014e34294273d9

SHA512
3e661951f37d3bf48363ef856c8dbb8c288ec1bafdbb7be5fe7e19176df24803afca71e41d47b5aee27dc4f334631d6f1d0670f7aedf8fdad64a8f090e9da1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c73fe29d436932228bfdff79d1e4ed9

SHA1
52fe39b5235e7081f05d0c58afe34ff06f46de03

SHA256
7dff86c6456677266cda54bdce0b8cd297d6b937f5312609430ea61dcc0c4ec8

SHA512
c0964a8207d3aef58d9afc8dd57ab5e5c431a2b3ceb7c5393a886435253874059724d973d37fc86967a5421f9f07de2e307fb83e6038dc8a39524df0af8f5143

Download Submit