439db6fc06ab57d917ca63e12dc88e758865f472de03c7595bd4e4c89a26d5c4

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97a054af4499ce5c99b03150226f4e50_JaffaCakes118.html
Size

72KB
MD5

97a054af4499ce5c99b03150226f4e50
SHA1

dde26c23d21264e7ac31e1b97209e44ac5db1966
SHA256

439db6fc06ab57d917ca63e12dc88e758865f472de03c7595bd4e4c89a26d5c4
SHA512

f6b4c0ffedb3d3b9559b471861e4f11654773c24b2f7462d728757e9515e37e3a0ceb1cf28a8ee996f4ce1f4226a99b20c0cb60ecb73c7139dbc63b377c28f7b
SSDEEP

1536:gBVD1T6OdxxdGw0nsRLz8BJtO3FSIt3nujX9txQTznBGoUxmUqNbrZSQrSeD:86Oldr0nsRLitO3/nujX9t6IzxmUqNb9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2432	msedge.exe
2432	msedge.exe
1000	identity_helper.exe
1000	identity_helper.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3668	2432	msedge.exe	83
PID 2432 wrote to memory of 3668	2432	msedge.exe	83
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 3804	2432	msedge.exe	84
PID 2432 wrote to memory of 2240	2432	msedge.exe	85
PID 2432 wrote to memory of 2240	2432	msedge.exe	85
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86
PID 2432 wrote to memory of 2492	2432	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\97a054af4499ce5c99b03150226f4e50_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8030d46f8,0x7ff8030d4708,0x7ff8030d4718
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1823683383408104438,3238909686250676277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9d767a1d451dc124a8e0b8bd80de408e

SHA1
1323ca62a34dcf3688bb5b65277055fd8fc7b015

SHA256
491106aae7bd90c17f4512213689a46ed71f47933da8226f2a0f4ed5e25169d5

SHA512
39880b62fe58302e2c6186e4f7c0406e5e7898dbd26cd7c89cc08d871e13eee3aff424e0262a0d040940a6b07d44835e196a2a4a854fb8800aaa0135725dc36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b8508667f4d935b6db3f84f05aed3d0d

SHA1
ff8a206ec430a228abf8c0825795c6c8169013c5

SHA256
09d026b04a67301d798aa4196b5271dd04b38b30bc299dc0b05b9a4b127dbe6b

SHA512
e6b04fe404a9f8ebb0bdcd2a507bb80104c04941bb17cdce6e955a9aab5d88173b2ba8a9ed00c7270a7c5675d1da96af2ffa55602d46f37d2604a17936561d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b4bc0b2159541f063abfc81a1d852ae

SHA1
8fe5856d5563c4c873bd63374c97773dd3c5d30b

SHA256
cc3943c98a74fe943350400281e292fcd616e520c0e4fef654f6072cea6c7f66

SHA512
8953ee7e7e5a7985c82ade74201e9b41e6b5800ea1b39a546f9dc32d77b613723c961fd73a49aedaa9c8e54b3f47808ca3d331b728ea80ceac2453f29eb05f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8cd58081cfa23d8f54be9737772f3e5d

SHA1
3e504b88d7c799064256629378a649d82a1d6a2a

SHA256
1a11b498e5855d78c96295bd8084da0d9a0b2772828691039c731f48ea50c02e

SHA512
5b136133f40d0a7969eef73fae842aa19d89b885816e636777c37433968cc7fecace5e9c4b9d101a92046fc269844005ede85e944b0857977792494908fed46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e07c22ece1faae377acff5ea451f6492

SHA1
61afebec3704b63cc9db11359822a31c1b74d1bc

SHA256
e3669eaccfd30c8c2b5441937f26fb3baad1fe0478cde022f06fac0992414f69

SHA512
8e4b1f876858c8b7b89ed0473b1deeb74012d2e562879705bafb2531f6160bc9028d52760f6e475dd7b0c24cb54e7d4ba0b604fb2d5ff025ae8d235aa75ae821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8a64ba0b25c6461793e0cefa371054d

SHA1
ca00362d2ea1ab76ea5e12312bbec0f8c75ce7c9

SHA256
4dce5aba7845193af839af635e852f511da3728da07adf46fa7782c79aa2a974

SHA512
cb9895866869c5de51591912a366a3e07d5e099a72c20b5c70a8768dd5a7577c01343852987c19c5603127e8aeff537c674fc8e9f40a81675c98fc937e5f94d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e549cbf074be9a8e34198a1734fb5782

SHA1
0d178e4db58411c354d0add121709f3d98c7c11c

SHA256
1befaa730383db6c7d2b89ae61521b518384be5a85ad5217095fb8f3a2289359

SHA512
b23fe0455ebac56791c9d0549b5860adf8886f08c57ab279f49d75998530f7922a75a261126d156247fa84cfa4bf8295174652b90d66df7b08fdc5c40f73e7f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39c5a30e420df90095e046362812861b

SHA1
b6c30ea0b3fcdb9e9bd1855d794cc02735ba28d8

SHA256
f7b9da1c29fc62cbdc66d5282c25130e5d1793c34587085dd3cc052b01d0906a

SHA512
e6014a1804418e3512e43ae1a7446abd9675561655d6420298a8e206f7f7b6c975fc32373b755317fc4db191cf198e5db900ba5112b94f81f0112bbde97563b5

Download Submit