dacb0a9c00822eb6f40b0abfb27a6c649c56e6bb8a5750a7bc80b3638349392f

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e46df918f8890b0f1e8ab1e49cbce78_JaffaCakes118.html
Size

21KB
MD5

0e46df918f8890b0f1e8ab1e49cbce78
SHA1

e9937d0940c2fb9db398632502af9201d66a0403
SHA256

dacb0a9c00822eb6f40b0abfb27a6c649c56e6bb8a5750a7bc80b3638349392f
SHA512

3479781b8625c7a314af025fc3a9747569c140ed28873a88db2bf524f7b8cf8d30d6e46cdd2bc9f6a67f4109550647bd32459dafde63449e21178ec5a2764688
SSDEEP

384:Wu62Kno0l0vcK/CV18ITHHpBg/XXjXY6bs2q2kz3cWj1AZq3GJ+HwigHtX01cVDL:SlT2ZL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
3580	msedge.exe
3580	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4876	3580	msedge.exe	81
PID 3580 wrote to memory of 4876	3580	msedge.exe	81
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 3996	3580	msedge.exe	82
PID 3580 wrote to memory of 5088	3580	msedge.exe	83
PID 3580 wrote to memory of 5088	3580	msedge.exe	83
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84
PID 3580 wrote to memory of 576	3580	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e46df918f8890b0f1e8ab1e49cbce78_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12ef46f8,0x7fff12ef4708,0x7fff12ef4718
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13537129939782944700,11074753298754256083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
a7d368d475241fc603f6b61d54473f95

SHA1
0085075b29a71363ff28a7f084ac8660e94caa9c

SHA256
9c1ca8e5f9c52cdb9f1e9e441989ba9eb6cecc328ea9f76967bf09868d60a365

SHA512
7b93bfed56d0ac8120e9ad2820450be678887dde7fb17f6f3efdbe81710b0bf52ba1cfc3082add330cfce1b9208fbb1ab808528ea4b86f4c19103919130e7e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b16e22874520ae22c81db0eea0d6b9e8

SHA1
0486597dd58ae5982b54b8ab0e9a879909c9f0d0

SHA256
a672c7b6ec1cb8d8ae742b3ee4bc0227e8d0f0ce17488f2ae5b2924d9a1b4f76

SHA512
2cc568994a63cd13452b5670eaea0ba7d7cb454bce04b58afabc8e92c067fde8ba7757f987babaa421928c627e8839f4e5f846a6e119d04f8b7995c40a6d293c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
644B

MD5
a6486b08460ba1ca36762265e376bc83

SHA1
f58b38a53aaadc7fa176c5aa71dd5fceaf607101

SHA256
8818137e5560e060f347b668f0e93147b022c07ee769d4299c164e13df36b932

SHA512
45580ed5143031001ef96d861565b65732e879d938e76526b497ba286a23f0faff379b8ebe8043b121f2fd83468c32b1360dbf9abe3ca1cbb21d74478fe16e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
056a1a2774d1719e84bf6b1ae49e0e88

SHA1
de22eb22ce3c5195fba420139422c54f2b743bd5

SHA256
9ec919db13968f81e84fb412dd8e449c5c5541d5483c9dd0ef33a82222996797

SHA512
4b60a1d662bf2629139151cc41e683467284c02df6814504305ba39ff3f2b5bf8524395d11ac0ca229403a14d6201b98dcf546766a6dea7999d080445a5fcf6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc5fc5f5cc65c263f6f914ae0e3efd6d

SHA1
b30be2bb9dbd7fb3f7a14c6857d54b76c9fbc3a1

SHA256
f1a2ee6017c7006ec19a0523dfbfee5e7653b2a427a4cf5a7d191efc3a72208c

SHA512
3b8687b7df53520b7d47b68e6513dd38537799f1d62073c3341830cadaf909f53ddfcf144999fc38015575c49529dba2a5a4bebbf9f25929521a68c3198c57c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9bc595ac8791e764be2149b23316e76

SHA1
389f87bfc33e411021866df81d87370f9e420028

SHA256
dae744e8581c3e5aa3d672270b666e651b40b1a8220654698557c3433b157ac7

SHA512
d9b33462cabe8b6ae087c513ca65d38ecda3346c90f5019d87a2d0a23ec7b05838b3afafbab9394c6b723bf3d25bc50cc3e4c45449f1db5a92fb310ae7ff6465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f98300072e1e5cf541cf94f3bb4ddb4c

SHA1
58f9ce5a5f87097014d2f7241554657dcbf8f312

SHA256
2cd71e702a5945a02f379c65a0115c59b99f10454915521f446d4e53d25bae51

SHA512
a66e20b21ebd2d3402fdb9b7fcb9161efed0f2144766913413c018e2534cbc822769cb37e03e27d487c24c6247fa71414f9c31c6d30a08929d02f836ac1695b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
00e753f3b56946ea4807feeba563ea15

SHA1
376fe128748e3a149ef4861b6abc619a11a77d39

SHA256
a4259b37b57a318ba4617256ba7fe2268e0d3cc5dc7160ef70978270c52d919d

SHA512
c596b364472d4f7ef081f841f396289cc8e840f0e7a388cb1cfc029cd24f0677e3c0fd3240ef84b42130088bbc964c46bd8f6d99a45d642d68de35792ef24f81

Download Submit