a4f83b4bab49560cfba1fe5c7f99a6f8bd7d0679d019f634e0ff09cf4e15baa0

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e5ab3996fbcffc8aa9432515166b16c_JaffaCakes118.html
Size

26KB
MD5

9e5ab3996fbcffc8aa9432515166b16c
SHA1

137eb31064ad160c97b5e90fbe2add6a1df7deae
SHA256

a4f83b4bab49560cfba1fe5c7f99a6f8bd7d0679d019f634e0ff09cf4e15baa0
SHA512

be6244059b252f15aec805b58bda8b922ab0dbfd36d56c21e0ea792b2ec09cc288f279dbc354a2cf03bd9f7d7dcb94d86b24df4acebb81d8e73c8b8d4da6be74
SSDEEP

384:cLihuYRirAI4JAjiUnWVXpLeMWzEuRimQV/nZSg6Uzge8afarN5eOWOt2rFjFSy+:cLONR4G+YpYwaeJUAGI1xw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
3152	msedge.exe
3152	msedge.exe
4776	identity_helper.exe
4776	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2936	3152	msedge.exe	81
PID 3152 wrote to memory of 2936	3152	msedge.exe	81
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 400	3152	msedge.exe	82
PID 3152 wrote to memory of 4840	3152	msedge.exe	83
PID 3152 wrote to memory of 4840	3152	msedge.exe	83
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84
PID 3152 wrote to memory of 3256	3152	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9e5ab3996fbcffc8aa9432515166b16c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb633a46f8,0x7ffb633a4708,0x7ffb633a4718
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6292042083362358004,14234262908914854555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:368

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x4e8
1⤵
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
e2e920205cb8beb23452e110bec1a0c1

SHA1
8b6ca396744dced4f244c83b0c6342261f394c67

SHA256
03c1a735fed2f376f02c07221172fb8bae84e298a3fed3a90ac9a68f25093909

SHA512
78ab973ff5be08df86deb7cc436cb5aaa7e854cc4d52a776e0804f1bef36e4a15ec1269c9efdade4042df789a05d8924b4122da2f08d24af9a51b3df9f52e195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
47f980e294aa3f26b5944dc53a0194f1

SHA1
88c8dfa6afa4f5ce0595dbc7e27b979d04e2efd2

SHA256
f3c636896fbe6822a2def6746d873f522e4414e678090352c332e479cf3b5050

SHA512
a3f3375695d182e248b2da384b48f122432681f799d3f9f0738da301e947322c3139422e78bbdb1300f0737b3922d1b4562b7bfcdc430d4879ed5b9f46ad1ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43e6754528d7b9d5dc91528d8dd0a4e8

SHA1
ac83c0ffe01b23e8a541b96c8fb257574f18f5e0

SHA256
4926387caf1864f772afc9dea62b56b58f8fe0cb462e9cc7e9843e249655271a

SHA512
e53d4a2e15fb254c1d0870367f70d00a2ddf331495b39dcc49e1e0200eb9b045ca12038a207a8a3801fa0c8c1b1251524e6c99008a030203b7734c1ace39a5eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e810ee71df6e095239ad6331fc8f44d7

SHA1
73387dfa6043514c6bd232c4e085d83c6ce51116

SHA256
51a11dbdba8cd2478f9e9ea36a1f02849e381536e92a442ff36a19aab861a328

SHA512
5b5a7bfe029ef24f43d4bb3b4a595f6c70c47b3a5fe65439bbdc0b0ecfb1e70a44f08bb6eb1380199f8070c572dffc0844ef4d6aeed2f4088665ff2d9d815256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4affd84b83864d375a41bb1bc44f9f61

SHA1
92e7bbb635030c2603907a2c0e62daca51b16a73

SHA256
51ba66215d2b185437a9db03ae3ab47f444e8eee15b3c15ba0e6a18b3311c834

SHA512
ef11d2c5e0dbf7301162e24fc1b1660b47bedc31a59f269393a3431374ef6236d476469445ea925b556ab2204d09b220b65af12a05c48ddf64633c790a213623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d0e9d2b21b8cef11acd59e11049efcab

SHA1
db79a05b8c27e243d83e54b63d472c3ee0d53ae9

SHA256
725bf7d9678029070d637894c5ba5175a5f335dbb95b588876a3a9a0376d3992

SHA512
14239965787b911f2e4dd4b3b886e9a1069a6575727453958dd8a10c0f2843c899b3d30cf2ab901cda624c9bab4f530b38133cc4676668b5e71d0f13358a72bf

Download Submit