463ebe5c720f78c7041d2b8a77350c4857cf22dd79246060d60f9233467cae65

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bd564ca127d855c9eccfa909dd19f92_JaffaCakes118.html
Size

40KB
MD5

3bd564ca127d855c9eccfa909dd19f92
SHA1

ee127e42cbb2f6b653a0d4a155b2165ba533e415
SHA256

463ebe5c720f78c7041d2b8a77350c4857cf22dd79246060d60f9233467cae65
SHA512

c6ed32727d5a5d13437bece147b43540ea348c77ea5fe81e4c620218c454285054000e7535e075bc6766cc62bbef2481dad0716517ad440c1cf6de8a6bbf1253
SSDEEP

768:S1rcvUX4UdMyCd+FuDG5Y1rUGWEpJ4GMHVzsk3pyFelDDFelX:SdcvUX4UdbQ5WwJ4GMHVzsQpPq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
2772	msedge.exe
2772	msedge.exe
1516	identity_helper.exe
1516	identity_helper.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2136	1128	msedge.exe	83
PID 1128 wrote to memory of 2136	1128	msedge.exe	83
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 3800	1128	msedge.exe	84
PID 1128 wrote to memory of 2772	1128	msedge.exe	85
PID 1128 wrote to memory of 2772	1128	msedge.exe	85
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86
PID 1128 wrote to memory of 3632	1128	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3bd564ca127d855c9eccfa909dd19f92_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8af0e46f8,0x7ff8af0e4708,0x7ff8af0e4718
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9421033211609947995,5643482054217965153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
f3bfa4207a79e6d5559239b0aa0545f4

SHA1
a6af276ad0635256bc3155e7a4386ec8db76ed62

SHA256
2a429955bb812977188b4c227e4fc916675750666cd5db0c0b4fd6077ce15b92

SHA512
d836d67040fd0be06cd54928af0ef612df9c81bad6ff48122e7099dd90f522a1f3ac43b2f261f82cd7db48439e1b8ad4a4bce296e0b8609f951e838f26db68f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e21cc39e204de51237ee129cd9f433da

SHA1
96c8dd05920b4d9cd902535de1181b4a33f92490

SHA256
5c2a9c6210cb49cda2c2859ac2f7001d51878f920d2aca9cf7cf48e31cf23e62

SHA512
8fc0a548c3e625cf64f6e4b544eedd31d992389fc044d988893bf8c09dd2c3dfc0bc21a9dad58b4b6a497b399acc7bad993fa98eb1b51676333ab45dad1292e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
54c72959bf211bff1247638afa054be0

SHA1
8f86e4c97610faf9822a174d4c212ce370dae197

SHA256
5e16a82991f576f7cf0f60f4dc0581cdc907c6aa214c1d1cfb9ba9b5d2ecb997

SHA512
d233b9126d58e655977f06047fc3e3129dd44d4d74bd922e3d1f87d01adca3a49273fb9fca611797abdf424ea4109b55cacf16e9e309ed8a80c0fde3edc67b3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a88fa03a1e4348924e221f8983b5c010

SHA1
d7b1d10fc1122cb553e0b7993621ed7b8196c6fe

SHA256
e9585becd582f6926b4cf6d4769e11337d7aaf453abfa21cfbda4f09e7491820

SHA512
f79eee408f8a71d4abf344b4187c3cd7734d5f0556d416fd939b85d976a833ba96a9013b3d2ff619fc53592dc32117cac1daee29bb869a6946879cfc85c79f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ac209228e87072049b344ca928ede34

SHA1
13cf72b2650a15446d09edc3c44a08301dd4a065

SHA256
09e20370ab8efbd1ca3e9b32d0d73a3a800c088f6aa047e70fc1dccc19818ef3

SHA512
c40a70b5f319bacae33fbb8f3eb409f202afc1a93bc4eb2d9eb35998bc5d0287eec49dcbd5750e3236473ad4bcf894c20718d7439754393876f4439483143b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5f59ba95b94e579ff3132954212b4318

SHA1
eddf50867b77d8177b7f182efe2abb96022b44a3

SHA256
1efa33e401663b42e143c9e574ad59ec3558536f14023b83b4e7e305e3c19061

SHA512
38fe38343ecc7e4f31c90be09dcdf5fbc1c71136e5645a68c0e2d81f4c581851c7f5885c57356aa18ebd671bf2f5fb3beb0e9c95e471ae1a0899feb4605c4b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9ebef80b674961e7df6043db501f903d

SHA1
56c56d9043f16c46a12ccb0d62fe3a8f69f472d9

SHA256
9b71da552449ed59479ebdceed7ed54367d9d13231069072f8219ec81c3b0063

SHA512
8a273448b1c14fe7895f57dbe7087c9d2174ef2dccd56179a2c9c72e69ce26012dc24ea11731adf6fe8f822060e9dd734896433e118f000753aac90b52e90743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9c2c1bec9c1f93bebc81bb070ad81eda

SHA1
7e59b97760b755b64a50613ab251c0a8e99f89e2

SHA256
14318b7d4da38b4ebee2989cb14e8df91595823887341ca705d872910c41d17a

SHA512
2e0cf80d63c36a5697f3db22a1e5172b630be297d1d2a2f967bc228bf3cd13fa5959f006b921ae976d415e1d484d8ef573a9b43996f372688a74fcf01e075005

Download Submit