9b3d19a1b74b85e4e61087dbe029968aaf24bed14aa18d72bd9a533727b8b204

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ee245afcefe6d21b0531ee12e8ef831_JaffaCakes118.html
Size

29KB
MD5

6ee245afcefe6d21b0531ee12e8ef831
SHA1

87baaebd01c7b76f53b250cb338a5a1a2298b6cc
SHA256

9b3d19a1b74b85e4e61087dbe029968aaf24bed14aa18d72bd9a533727b8b204
SHA512

7abe95750c60cf726b739cdf4a1b21ae42ed0a0fcc21796379bce0bca936aac46d012078a836f6c82bf3550b7a82882bdb6b92b526a3ecdd25330a02017a1f30
SSDEEP

384:TUB46rfq5enJ3HaeuZnAdxGYiJ+JQuItwH8OV4mQmjv3lrWB6ijX:p+q5enJ3aeUnMgYiJ+JQftwH/9fijX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
5028	msedge.exe
5028	msedge.exe
5232	identity_helper.exe
5232	identity_helper.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4344	5028	msedge.exe	82
PID 5028 wrote to memory of 4344	5028	msedge.exe	82
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 3276	5028	msedge.exe	83
PID 5028 wrote to memory of 2752	5028	msedge.exe	84
PID 5028 wrote to memory of 2752	5028	msedge.exe	84
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85
PID 5028 wrote to memory of 2616	5028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6ee245afcefe6d21b0531ee12e8ef831_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef94246f8,0x7ffef9424708,0x7ffef9424718
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,16317560807322824317,14865353334335440776,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
43d9f54f76a72d946028ff31665eb58c

SHA1
3628d03e29b37066ff72903cf9d1a195feb25526

SHA256
16745a2004d197610b6653e593d8b51af788aa6f07fabdf05a75f14fdf1c91ac

SHA512
a82892c2a76bf18c3135a19cb26e1bd5b66d99c4e863773b4d91d67bea86ef69da078262d29f597c8c8eab2ed4466944c77a333ada400d51b3bf9d8d37f1c8e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
1b6df87c17ad2177b1d024eda7cfb895

SHA1
6163ed586d0fda960190f7c2ed65b44a7b742240

SHA256
a81251609eb3852fe628f9fe575f1f8c47cd221e09a04b5031d83dc92b6f6d41

SHA512
beec73ecf88f870ffc9825ea9ab7ed259f425de9db36e83fac0d6e7466c84b7f720515c19b95f0c0866ea59d2db02c7ead698edc4341c9bc77548fa4f0ba7f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5ecf648c44d3a6fb8b0267925bf3fb3b

SHA1
2577c0f134b03f9a6679392b7754646fc8d9f6d3

SHA256
29869276e0545613c61741d15ac9cabd09421ccc51f97d115cd93041e246aef6

SHA512
c09993174583beaad619a0cdba3a15b549ddb609aa86853d38b048fea5030a3214cdc2ba94b0e3f713a43a8700d0217156dcabad1e9707761d43ef991e6b9ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1eed9808175559c240bab6ac7cabe453

SHA1
5c46ef13c9239ea092dd432eb16950591b63b76e

SHA256
552bf2cae9e20a6d111d9e61edf78e29e4f8a55fe17ec49db6b6f8be3a0d875a

SHA512
10e86bf6cac92a8bc345935a4cf282517e9506ab296382bbeff108ddf843327c0bb2b7d44d9ca09d76405e015d25f06d0ef72dc28f738c081ca7695df888468a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2fb972e735f4c0aded40baa556d79cb5

SHA1
96ab48503e5a013dd3bc420b6b60435836dcf6b1

SHA256
adea9c8f7f3a7c95c971daa2e289ad8ece951ed127921be44bf74b9a6be63b43

SHA512
a827c212e7b9a3003f59ba8911a7e5d29cbcad7a98d658c1d96eb04904dc2d306672582198bd63eba3482a5e2e61a7c6f2548cd114cbc24da3a8c8964a296cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e44ea2df222db74083b82590ff915b42

SHA1
e816ae50ef6bb25f0109f51331d16d3a15504d13

SHA256
af118f63c9fc0099c2bc28223ed3b989aab20cea232613d3b5f8b7c2194d22f0

SHA512
8f59e263623238409f4287d2e019851f5297db16ecdc33ed0c83ec65b4f576cabd944be978f13ed9d5a8d59819aba8483365099a876b691d3e642fc7fbbcec21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b7ce0258f1d5bd110499468522b9e4b5

SHA1
e0c39065ebe1e43392b35102b1ace14db6a454e3

SHA256
8d57831dce2e2d84cd002bec1bd46e1194e433979e3dcef52fd4f748aae6b57f

SHA512
174f309a0b816eefc2455ced06cf26bd42f07597c6b0a8ff0ab4ccf43bfb4b4b75b491bac2148b30fdfa84811b4351a5c6ee404416e2aec956e2f9760dfa13a0

Download Submit