3c3bbd0d3cf862859905c41c3ba6bdf1686c00ef46cb8e3365ae1042c975299a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f6be7ee01b2abd14e6c320caec6e678_JaffaCakes118.html
Size

46KB
MD5

6f6be7ee01b2abd14e6c320caec6e678
SHA1

5ecd9c2f64275e5e669dc66b2776f163f535d505
SHA256

3c3bbd0d3cf862859905c41c3ba6bdf1686c00ef46cb8e3365ae1042c975299a
SHA512

23bef31e09b124986e6fb707a20dc7a62be87ed35c250ea3fbd3a293c636ff9fbd7e442f6d12aa11f1f5a369aefe8c11ff4969f4bbf2f17b519e11f31cfb5771
SSDEEP

768:rayHHvPWloMuSbLwcTL+MME92mGkEW/OiCozaujFJyA91vC:r3HH2ldbLvTL+E92mLmiCAjPyA94

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
4472	msedge.exe
4472	msedge.exe
220	identity_helper.exe
220	identity_helper.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2920	4472	msedge.exe	82
PID 4472 wrote to memory of 2920	4472	msedge.exe	82
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 1820	4472	msedge.exe	83
PID 4472 wrote to memory of 5092	4472	msedge.exe	84
PID 4472 wrote to memory of 5092	4472	msedge.exe	84
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85
PID 4472 wrote to memory of 2516	4472	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f6be7ee01b2abd14e6c320caec6e678_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae74718
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,9597206845725158210,9442089952215111577,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
adec979b71abba7858500c7d02a27cd1

SHA1
4dfe916ec24d96050f3f178d80d45853364b88b2

SHA256
865de97d148c1206f7599436e356042a2f4f1e2f453e68197294b6eccdc7c761

SHA512
2f3fb42c05854b5c7a35e54bc4617a6be096989dbdb96c6e0122ecea32db53a44859d43bf647aeed3efadcc447e86096b21c2289084d22ba0866ab5d3f83f863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
e512dbd0abf35b77c34fe42cfe9e90f8

SHA1
37ffb504ba76d2d9a9c8afeaeeeb353fb4459e2f

SHA256
1dc67dbf49f6c9a52b6cd858a59dafb5c7b0a5b5ad6ffcff8f1e1dfd8e74c1c3

SHA512
6214ccc69a35299a06b9bba002e06716074820500a764dd1342a220376578cf00fe94c2b5c0ab754892341183dda1d5dd13c05e4fa7e2039bbbe08ea1abbc667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
04160bace8e47e74556cf2de5470b9b3

SHA1
bf5c7007746ea271d4336eb16d0058f2df6a9dd6

SHA256
ddc2ede48231e346b2c30e480b7091c8b7f07914434413156c762550a7fc8930

SHA512
d6e0dd233c0c0d5128cf0d07e7d23ea1b5892dcf04f06401234ea1b21e2adfc90754b40eea3d88f394eb4b21d0d5b8d11bf429afce058115b8aa676f24df10c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
57150e8ec6ebf1a693fa7c3c1843acf2

SHA1
6b13b1544c852b6875d46dcca7651d9d98f65889

SHA256
c8cf374893bb0a649729f93574ea83c2cc5b4cbf17170d2799c4c4c9b8851586

SHA512
d90a296e19388f692dbbfab1830c55645bf2a1e4c0aaaa689b67bfe29fdb8191bac7821702d58b35982fed1f9778f34a88319ab75a24157c8bd53634be1c2831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
05cdcd403b906a20137d47ce482944d3

SHA1
6e66bea2b29f19f7c7199bc593f8238d4503c530

SHA256
1ae229872f3febf514b2e7c35bc297faec628e536ba0ee8cae3db66a06a4cde2

SHA512
b70508459b351b020d03999338f8104c3cdf1d37e90a391d287b767db264180a816984274b755a433a1c53b2e7b0afcf2172447ed3a034dfac266e63e3fc487b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa0e29c6b7050cf33313c64351ec4674

SHA1
3807fd7af416b6b7fbe25773f7a374709a3418b1

SHA256
da48799603524e59b0caa8f9fbd5d9ff61dc6386d198c6603f3fdd895aed0527

SHA512
7100dbdc1f11b23c2926cdcf2b75f51c6b43e51e77891e7d3f6a34f78c47db6ec1b902e8245c2b5bf30774c3987d19c76a84607b2d2a59682c75c3dbafda0fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
12b5fe0536151560dd8768b1eeca429e

SHA1
f376c62a25e5b591a86c79a73fcd98721c1e614c

SHA256
33b4e6ccb56156d939850068f5b0f95a7b68293e266dfac6a05eb3745a62a568

SHA512
ee6bd2141463b778bb5caba5c193b0be5db8b9dd0718b4116fdc5ac3381374a2e85a30f6063bdcd467b5e2b576af6f058f5a3316cec91370aba19286568a868c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dbddb8375d299c15e3f6266d5e94effc

SHA1
b84997429e0d3a902da5c838e472aaf75d1d9603

SHA256
19bea83d82f207fd8795ccc3df0d68eeb01cf5dc46eb5b1a735073abb34adcdf

SHA512
5cf6b635c4ea93ad3e73ee048c2351fff75e5fd6681cb1a4e853a307cbc07dfc8312485a325f168856329a1c1837c024ab6e7d44f2e9c5efc78947e724e376d7

Download Submit