f212e77d9f54ee66b18b188991b4df3f37f5cfec31bff7ad7b78724c5b4b6e2b

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

947601a76b3fd4756c2a32c437e04529_JaffaCakes118.html
Size

45KB
MD5

947601a76b3fd4756c2a32c437e04529
SHA1

ccf0f663ffb3d511529ae122844ca6631df69b4c
SHA256

f212e77d9f54ee66b18b188991b4df3f37f5cfec31bff7ad7b78724c5b4b6e2b
SHA512

222a253ddb0f1ff16fb6385f0c45e1579349e41756f29b87a5cf79394c87b87e688424100b5ef5aa05a46075102d8adaa46d7118597c96ab45fa4d2a89dd6426
SSDEEP

768:1Qm9skclujpoBSp8bPSTKs6njArdh9Oc0x/luSF2Y+J34Rj1eoNaxVR2Sk7:10kclE9Oc232Y+J8N0Va

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3808	msedge.exe
3808	msedge.exe
5008	identity_helper.exe
5008	identity_helper.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 544	3808	msedge.exe	81
PID 3808 wrote to memory of 544	3808	msedge.exe	81
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 4412	3808	msedge.exe	83
PID 3808 wrote to memory of 3452	3808	msedge.exe	84
PID 3808 wrote to memory of 3452	3808	msedge.exe	84
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85
PID 3808 wrote to memory of 4936	3808	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\947601a76b3fd4756c2a32c437e04529_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e2e46f8,0x7ffd5e2e4708,0x7ffd5e2e4718
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13689239145886967239,5223944251691185605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
42e7643a5f917edc5b9ed8ec5e657a13

SHA1
93b72a64cc5ef6f409d0c903018f4e21e05c9d73

SHA256
5b0d1876a8fdd4a07dbbcfc2db2acff918032f09f49dd6c3ff53a938f315f466

SHA512
ee1656d1d756a86a2f48046ece6b23ffc3246f49af7ed39f17386c18ee5e1314a8fd796d3e9c9b9b3c28b7ad2e6870cdb03463eff770f46d832ef924c98bf0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c4e307f185b0deba4a6c3dd80aeda1b6

SHA1
ee208bb9b7103664694f5abbb1510c35cba9428e

SHA256
59e1ef9b7ed7a27fa68237a4771ddf45437ebf99f51f38e6fbd0fd6b32f47778

SHA512
323e498772084b4bfdb97d850e78d9b11dc070836eaa9a617d839d5e85931046c227804868bc7ab0e2d49ae076586ed8bbdd9c37ca054572c8df73cf482b7669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
600dad113cd7ec0a88b7e14f6d6c48f3

SHA1
461f7f330119a8977c5e404608256046449b65f1

SHA256
8ba1aa2d2b5db94025cbf11c5a6c944f052ec261ba6a4c9f7b6e8b9d136e4564

SHA512
7c9fec83499fd336f4872a836767b51a45d54cb4ad067f79d91991fff4c356006f3273c5c2a94c7d26412da44db773920061b563ccea27fbc744f6d72bf5632d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee7a5625cff09dd2bd1471d8966d44ca

SHA1
c96373a2e5872a6bda567e98355f6fa9876e054a

SHA256
e6e5fa05d428a2eea3ffdfb90e66c92c77c8df6e0889eca7e4895dcdbccc5a9e

SHA512
45d1148d4405b050e8801afcca52714db92bfb770ade2f7a50fe024489b42e9a41a56d9e9ccdc0a0dc545cea5bb7a593246bc273df73a1ad8ccc5ec1a9398009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b28981919cb7abacecba1f08b0ad853

SHA1
5a2bb071142128167a8f07f147967fad2cb26776

SHA256
c18be12ecb98580ba78399dba5cd7f29ca85a16bc2137a4ea710460b571f8ee2

SHA512
0d8b946f46d42b3f45d8171ce02ca304b584e9a8ea02405b4598231e67c207433d08a596754dc24c2431077e4d336c4090639a3a5dc61ff6912fa977b11ded29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
384d53e8fb43bd38075161db1eb44ac5

SHA1
2ed8b4d565a28d3ff2e78163dd2772d990390f2a

SHA256
b7071f44fbd7dc90e6ceab7ca740339a0a38cb8bda2694ef92bff571f361037a

SHA512
bd32b84851230a262cb642a78059a3ab774186554e8ce87b6d7882d6aa426089d1679ffcca380e61af4beda5c6b77f5a318072600ca45d66ea08ea5f0c9741bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e2b372c1c1beb6969600b649a69f481

SHA1
0425bd2d09d787eb7a8e5b76460f423ddc3ade00

SHA256
53d5e0a569193d9cb5f0919f7235de577d69b4c0445e912265a2850a0d317306

SHA512
89afa271f3e54d1367ad7877e79e6db4633ab8787baaf32f239b5cf91a5bd848b509efc7a657f0102b29612344098fa71f223d89bc2b489dd6ab04e88c769728

Download Submit