65ae4dc801b2414ba4cb4d40f1afb386c314f79596ca2848673d5681de45ed38

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62e520fd4a0625e1b8ba7c36a2712e4c_JaffaCakes118.html
Size

137KB
MD5

62e520fd4a0625e1b8ba7c36a2712e4c
SHA1

737c467a89519c1774a48b8c325ed7b22b440469
SHA256

65ae4dc801b2414ba4cb4d40f1afb386c314f79596ca2848673d5681de45ed38
SHA512

8ce70c6e5ef18137357528b157d8e6a26c0eff8a4e16391026b161bd10703976d0788ffa4eac36226cdbaa1662174cd94d10695657b377b03fed09b38c6e5217
SSDEEP

3072:rIEPlGOif8BmMIHNwKRJkMA9puM2gjxG3+II8Jv91LU:vmMIHNwykMA9puqR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
3340	msedge.exe
3340	msedge.exe
5052	identity_helper.exe
5052	identity_helper.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 1756	3340	msedge.exe	84
PID 3340 wrote to memory of 1756	3340	msedge.exe	84
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 3360	3340	msedge.exe	85
PID 3340 wrote to memory of 1372	3340	msedge.exe	86
PID 3340 wrote to memory of 1372	3340	msedge.exe	86
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87
PID 3340 wrote to memory of 1104	3340	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\62e520fd4a0625e1b8ba7c36a2712e4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d4718
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10055847711416696081,14142600844711899922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
586c31fa525567d783167ea68cdcad46

SHA1
ba36b6d0ea9997f9599bcb4661178faaee1d909c

SHA256
13085b43109b79dda2c2777b94017d996ca88879ddd0be29a49f72f384d83ad1

SHA512
b34f4dab52261fb23b27495dc7df98d107987a12b1ae66d49240c887dbb14dc7366107d2f05b9a0a95514f710a4131b9811f99bc637bd717d385993ba3e18767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a5a4880291333312dd00de213d1da620

SHA1
1ac96381958b8d8c11fc0f0efeda8eb3332ca7b5

SHA256
ac1749018457e0a5c8d21d7ac4990d3f7aac7501f51898cecb14ed214aa0e1cd

SHA512
2ea074efec33bd1a4dd5c4d5614f4827ad40f02fa24e4cb4720d072419685a10c65a24c697ba6fc434f640bfdd3c919da68b7ee9b04f6028490777b11c5c01dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
19af17730744df1d25f9bb31a6ff07f6

SHA1
085a5c8f1777b0cc700b92286bdfe88d1e396760

SHA256
fa9e96e083e887460f4f088c619ca62e02db03251f79ee1865e84608b552c6e8

SHA512
37cbf67e3ea912e7fcbf95d0a56f733e5ba452f338160c49698852b3db8c4bda14ef4e2d9cb07d04e6c3fbed7dfddf890e14a7e679aad4c0a4162fc2c82088bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a44a79de5238b1a59c45e5c9ec5cca51

SHA1
7bc304f52dd13e1934463dd4c694f01d5ac263b2

SHA256
68abe050058f818c60be60da63676eb54da9978b2b1e178069d39255e9631f4d

SHA512
3a613c665f6f8a7b582047da636c0b0c832cc248e22f75f6bdc78b141ee26d07a5b3a0c813f18a2d1605ada32de075b5d8b1c6a0d10020e9ee26173df6bfb1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9845b53c7aa06ad64d698d05e3997a80

SHA1
7e9adaa1dd310b570340adb4c741dd51318f48b5

SHA256
3a3eeb8682f4e848845bc8461fa2618108876e6b45cadaffe8fa0ecf98fdf28c

SHA512
5e6e866c4e8fcf8189ca94051afe2a3e45c49257e5e06eb8570da94f8b910735fff616e4f605b0288462bde63b031db0f872154214cfc006422f4dd81e965455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb8e52b1c5cc1b463a580d32377b2aa0

SHA1
5c227bd81de10998de6c2a6e6001c5ddbf4aa2ef

SHA256
f38ec630198fcb776d0125a7c13433116de6d97ef320322ded88172d97ff0fd9

SHA512
dac36a9ac17d11902ba155977c59fbd7b36cd8f594434b97a5a19bfab97419d8a72188a9c91a503dba53353ced3bd44e6ac57ba0db740ce3fb70295be6cbe2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
79cc1711244b80da5d3711885a00f53c

SHA1
9ecb8e29446ef6b5328e69ef5c835d0018e97aff

SHA256
e3553d081ad554842f907c0aa57ca680206762298e0b3232cd36c6821d61ad6f

SHA512
7d88c5be2ef8169c92801cee8bd12464594f2b43ac21bf42a9276347b37cc3791676183ec82b4528028b710ed5d459fb20fe9eadc600d4547b6351f74d765d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b5e89c759fda67e61247c59c3d9ebe3

SHA1
ee60262da92d6d32534d31b822bf5a481e7a4b2e

SHA256
62642d1055ce3268b5810475d18c7bd67139eab504ed830e1414f256f6aff407

SHA512
7b8e76c746273892e1e5c38d7eedf3c34c90a0790e3c588397c35348fcec635f267617a9eedfe47dbeffc58559e13e25137601137b87aaa0d256f954992b7c8c

Download Submit