182674e4939e6e6f0cc42defd3b9ddba88fc94dd5e25991c62faee5dab22621b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70949adc6ba1d663678e83c1cd946bd1_JaffaCakes118.html
Size

72KB
MD5

70949adc6ba1d663678e83c1cd946bd1
SHA1

f52c63f2a64cc6a403ad25be45ee659375c84b4e
SHA256

182674e4939e6e6f0cc42defd3b9ddba88fc94dd5e25991c62faee5dab22621b
SHA512

7d838d66f7bed376aec1eaf9517fd818248c844c13b5e510a7b2195b2f822ab5f9485f0b0d04eff4fd9e426693d0f013d7b1d1776f7fc290d1fb0aa25864f4be
SSDEEP

1536:O4R5spj3eGzR0m0OKwyrPkoVdohR7Q3+Sz:O4R5spj3eIumjK9rPkoVdoR7Q3+Sz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4628	msedge.exe
4628	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1232	4628	msedge.exe	82
PID 4628 wrote to memory of 1232	4628	msedge.exe	82
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 996	4628	msedge.exe	83
PID 4628 wrote to memory of 4380	4628	msedge.exe	84
PID 4628 wrote to memory of 4380	4628	msedge.exe	84
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85
PID 4628 wrote to memory of 4956	4628	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70949adc6ba1d663678e83c1cd946bd1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4e4345ffc91248d8197236b46f5cb432

SHA1
c27561b280eca306caf7b3f3fdc1662983b1629d

SHA256
c8206283bf10612cf18e831d469f72341ceaf305da115570571052dc86843a47

SHA512
f3100f0556c1bc8f89e4f228b7f7bb1fb5696fa11b2788174f5f3200d5fcfe960de5f9945783bdb815157f7663d119f3534daed7b39aa4fe3d3de90ff4dbd74f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
75d8b719a1964aed8aaf1d41eafa3f30

SHA1
02f30b0c974f234b215c2c75ad488a7d4e138773

SHA256
6e686c0e8a381655c6c9a7a794d80f5a0bd375cae08ed006e35cb8970c63a5de

SHA512
e86d45fbd17710c5af6072a9c4ff51d44505d76634ab7c867b19331d434604203c8d107323799b39b5fff924dc85fd51fc4ca5c58a45db1b682bd737fee6a355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e5c7b6bd086d64cf662364d850dc1f90

SHA1
e85556c008ce44ec3e8b22a79ea3442ef4513bba

SHA256
6c37790830c33b15d31376ffba212a6270676bcdd6ec50efcceef6efa138641a

SHA512
956ba9fc15846f079de493b454b786ff93ecc322e144a4c1925ff8e2569bd00a818a09442f0116c35e3894e109faa2a95e297d3d424b34b02ec981c208967a6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
056c00d3743990840793bb5dd11cff17

SHA1
6162141565a54a32001435e72461afeffe153c3a

SHA256
81bef5785b34f4d8bb24944d7418d6f6b865b47d5d172e6e6c1ef32087a27ca8

SHA512
442b62dcf4c078f017b84b2ab395f2b3b50c220814fc75b7d3857ccab20542dc831645aaf4148ea9976c253eb28a77b44a33dda26b363ddceb7daebfaf759c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
471296f8d441520e539e5e6b2590c2b5

SHA1
0bd2b7f6714b90b284dcf9702243cdc72ae2d859

SHA256
6f5a1ba06cca532dbce380a876ddbd4f3e14d1767c82a20140f63730f1d14b8f

SHA512
b1ca78198620792bf05f9b29b9d4d82a1e742e4f6575e6662292acd3dbf8caa427187111b0125688b10c86c2617007ada66d6c19fced8a9bda43601b9e9f92aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cd1ee45cce160958888165939b50c1be

SHA1
4df94a42cc631c1b58b380e3b347047305c987e0

SHA256
6f35beabc0e5d0da6b7a78f1f45bc969fef5916ddfb3f65b0878a51b3bcff044

SHA512
e542f59fbb65665f57897726aacf0b7917c5850090040c6e89221f0b39e8ffc4972c53d2f4bbc89966b0d36766d1d797d3fa396a43059ec9aadefae12f019fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0877425ced00c41ad36d2d9f1b99fdd4

SHA1
2455dfeca55a8a8af6aa3529c5b3d25f1265f05e

SHA256
99bb5c036b475b5047a8b24da1df6cc796a2ffed76a7af506ab454541309c85d

SHA512
b9e2e5344651705693f3c1d3647975ea6c92daf8aeb194b721bb0aa6753a8812f1d2c5cb987e388ffd5b06376e7000c8089e6e7967bad5a6798653e01731a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87cf3ed699d3a9601bd60c58ba65d6fc

SHA1
e449b233d25ba0d3e00e7f789d113f21b62a8c69

SHA256
aabbb615239a714a44d53fa0d8ed7e810590c4d250f4c953009afcc058c34d45

SHA512
b5593236c9b82e3a3ad30b2c5e938312a0adac8c8af4a78a0f30ad66837d31a8a8c97d146fae263886a70fbf2d1b8015007c3183c740d2d53b642ae8ac1761a1

Download Submit