004037df63f70015b4ab7a6930b055fcb9477d239adc18a3710b396d9e45d32a

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c572c4681ccd7837c145886dffa207b_JaffaCakes118.html
Size

70KB
MD5

4c572c4681ccd7837c145886dffa207b
SHA1

31aa0504eb53b1587f7361887db70db66bd579d3
SHA256

004037df63f70015b4ab7a6930b055fcb9477d239adc18a3710b396d9e45d32a
SHA512

9698f508df50fcf3946a2fe554f67907d677362c75248b120b828e3e24b4de477cf2c3a989427c008cf266273dea91926a3f48e5e81639ba369586762c712745
SSDEEP

1536:79xrLksA/iGU02n0+QeblK+pqM+UbEG+b+X+X/lK+XGYy+XH+N+pnz4YiH:LLksAaJHL1CNJrT9X1jiH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1936	msedge.exe
1936	msedge.exe
2524	identity_helper.exe
2524	identity_helper.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2084	1936	msedge.exe	84
PID 1936 wrote to memory of 2084	1936	msedge.exe	84
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1840	1936	msedge.exe	85
PID 1936 wrote to memory of 1660	1936	msedge.exe	86
PID 1936 wrote to memory of 1660	1936	msedge.exe	86
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87
PID 1936 wrote to memory of 3348	1936	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c572c4681ccd7837c145886dffa207b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffd7e2546f8,0x7ffd7e254708,0x7ffd7e254718
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9174002017390480907,11481448539906520227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3a0 0x2f4
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
f474dfd6d7390fdb9b2dfe3f4564feca

SHA1
be0b4cc07811c8cd50c57a5413fb2e34d4200d00

SHA256
e87e4fa96c9b83c793ae0e5ba1569e2ec63c0c7fe2bf83499a0778ae360cfba7

SHA512
257bab86d630d0c61488436c69ebaea5123e6c353839211c1e191e6cbbd73487673cc4cf95cbc91e5f33a96aa1177de7301afe7a36f5ce9b24d8e54c36b317d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
73b1a8975d47a52930866baf950c8b35

SHA1
3e3e32766c56819b7b4cc0989e18ceb50d3f96b3

SHA256
5d4572bf392e65a738dc66535443a967c8ec9369c92293b0e7d9800682e204ea

SHA512
09e296f14707ccee80d7ba24daace414001ec3df731f8cb9fb7873e8250adc6b9f8739a39021ac54946037badf1662b5993ab363eca42a3051013c40e9f20e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d8e95a283b90b60224ff609b982a1ce3

SHA1
7a40734142c0df7be7e735b35bbf6885c95d94bd

SHA256
058c225d1052eb6ec8f445d6050bc03b34d403e3be7414bfea6e8e61648d2576

SHA512
bc146bd8e997f53da0e24ea366a2385048f27670be0d452e2315aca35339aaf0fab4f8d227f80b9b8d63be290cf5a014f2135d34a5c554c4948902bd945f7cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
80c3a3430759e788bd2c329ee318a741

SHA1
5449ed72a472441b7cbd532e96ff2e25a09763b0

SHA256
ff865dd097b0582987bde5e4e29c9fb7dcce58cc51126e532e58ce526807be77

SHA512
c26c18c0ce95a6364ba4beb57842e7070a039d1d0ad3f2dc370a1020389af74ae2008c10a598d40dcc822df3f256e0d4f88f34e3fa2a77bc281b54bc85897bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fed3ab22da0426e7b49fa285cb1de03b

SHA1
9d640a5ad0eb06cd67186b72a86a9b7adcd0c472

SHA256
32df88ad7f3f6d72c081193faf5c15be3230088161e202ee1d4002007a5261b4

SHA512
27df7ae7341ec7c5037f93202ef41dfdb34a8c570005c32af6b677243bf982a6ad87d6590fa86a38b0f1c14c7ad42671f3fda58ac55b0183e3eaecad97ced7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9d698f160cae8b7b2a564e9dbe25e5d

SHA1
9bc86c976949b9fe2f85afe490e9bfb960e9d20d

SHA256
5cc0b07892baad35f37cae0f5bfbf4bf6791d75087da9b5d6eabd94925097ce7

SHA512
4fc37487d103ce2e828dbca5b83e1b5d72f1661759f66a467fc7ed85c218269ae5f3a193edaf3b0c658310689e3a35be471c0948ae7550d3e5c944749521f680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee2b09746aabfdb960df42116e2a4aa7

SHA1
b3fbd18d40fb6ab4dd33ededd9d494f7c35cc036

SHA256
830a01e0852d9851953e7aeb3dc8746047981cc4609f904edfa4d1202d891c98

SHA512
bc229f35b7c6e9312c47995d0717ee182050f59c92a37d98bd708ed27a0f735927504a15bdf6a2049d82c361cd53fd5454c72709068223a701292b0d22ce8e5b

Download Submit