258cac38f54b79b12bfaf387b3d8915474f06e9aacfa25e84ae7f4cf475605af

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a3a38c2ce00057b7ab8a1af78ce7365_JaffaCakes118.html
Size

68KB
MD5

5a3a38c2ce00057b7ab8a1af78ce7365
SHA1

75d1dbc3e10ed20bd6dda65a52460ffc75961176
SHA256

258cac38f54b79b12bfaf387b3d8915474f06e9aacfa25e84ae7f4cf475605af
SHA512

e21a40f720ec0addc9bf8e6e4112f940a545523c41c39e8339e632334a5f478c32f23f4e41d7d7788ac951566b54221e5cfc2984939d84db51f26fef2c464b67
SSDEEP

768:1La3kvNoryQOk+JSKEJL6Jk+Ou2ICXN9TmnHvBnD7vgu:1NSjL9oHvB3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
2148	msedge.exe
2148	msedge.exe
4704	identity_helper.exe
4704	identity_helper.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2176	2148	msedge.exe	84
PID 2148 wrote to memory of 2176	2148	msedge.exe	84
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 4968	2148	msedge.exe	85
PID 2148 wrote to memory of 3744	2148	msedge.exe	86
PID 2148 wrote to memory of 3744	2148	msedge.exe	86
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87
PID 2148 wrote to memory of 4228	2148	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5a3a38c2ce00057b7ab8a1af78ce7365_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc72146f8,0x7ffcc7214708,0x7ffcc7214718
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1272 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7690565877231767209,13038402242024754081,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a118556-14b9-4a9d-8756-87f2775aa17f.tmp

Filesize
5KB

MD5
682b27b9082dc12d81b8cfb48b3478bb

SHA1
8edb5416abb084a5eba013e15a299793d3d216df

SHA256
c4139918bbd211c87fc22ac4f03377b7e84226c05557bd3570e176c841533e4e

SHA512
165ac078b3cabd01ee05d4dafd2e11ffc473947a5db719025535348a054774e98e24c3a63ad20d60d5bbd5a6a594679f6eefefede4fe0b34f3262beb83dcd3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
73KB

MD5
d69e241d45009425250c15ff94de51e5

SHA1
6e95bc2f11ba319eaae67eef7b8f9bd185362551

SHA256
1ac17bc1894e5a14b46bbf03830cf7f47c6d08325bc9ab430f49cd2382f3daf7

SHA512
735b120207f307b233778866b06cca5a2475b94a922e1198193e80d440cd94beb90c4b39ec5d4ecdb2a90acb9836772ae8862ed2ec5ed943b1ea0363e399bcfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
36ceab284c2e02bd8fbdcbd294b0e082

SHA1
503788e5090b7f1256daa8b63059802f06ccfc02

SHA256
7846847a66a3d4013b57223f6be34443ca3035c5d9f86dd15e3f211e18e8880d

SHA512
ffa4954d659863a93e7bffdf0d23719943c3acfaa9dad0eb64a5b8f2d44b8a6905064f08303f415f72b71e0cd65806e100a7996f95b205d76b4adda470867e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8b1557091a498749ee8a47d38765a65e

SHA1
b88318c8728e91184bcc2ae3463abafa4dfc3097

SHA256
747cb08c921f9ae0041a8cec3294595577b4bb44d5d49c9708603a4f6efb5fb9

SHA512
450f18989ebf5a61c9cb39406516f3a1e3dcb0346777804f8f18ccc70ebc3feceb421e8e1066528610cff9f7275dd031424f652c5571bee1f01ff0c04e35a278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
506b15c5a56e53708565de685f88a742

SHA1
2787e429f505cd6049529221085f7c0271af49a5

SHA256
a66604db539fef6dc0c9b428d7703bcac0bd3e77f1f6060c87dd3fffe8b5e531

SHA512
6a3845310f422ef3e59907e9ae4c6f86a303dac419917a64851b6c2a90f2b22bb57ea2909d5c628c477a5dd489292803248f0a9c061fc6d449f0d43a84fd848b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a027faaed31f60fe43861928d924a848

SHA1
dde8241faf09215f7e5966ae2c646f449fcb09ef

SHA256
6c1f71c0c6c849105a4f3a352b0664ec4661140e2e4429099140149218b554f7

SHA512
ce1bea98cc4e6f4d488def3bace2a4976a6ed3aad8b324a251a2caa48e6b1a66c9b84b7c73ac774e8ba48d3ec7ba16ce412dd852bed27eb90daccc5dbbf73c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8728f20af19c717437a4d23d98c6b6aa

SHA1
7fc12db1a28a221f59248b8a34c7522c9edec114

SHA256
baec970d7b2ca5405a5c076ffee4d852cbc41b7413904af0a9b1df0d8953960b

SHA512
c52437883fe10bced08a1ee0a886d823349f2a423d795303037a4d2c607296f66cfcf61fcffb9b63b77bf205cfa072cb7ee0aff8392b0699a650086155eedf9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
49ac7769b717722743ae7444ecdc62c7

SHA1
cae75fdcb9f7c735c49575d34204d8ad972df69e

SHA256
4eb62b66bfd26bf4bcd5910df6fc9c32c34b96f205261429fd47164cff7ad013

SHA512
545fb86a604a44dcba68e3d0c0d394fa75646e657e81a83cabd3831f0877306f09b7f8091f79b4e3db9df305b40ddc1c7bdbd228b6eee40f5814f09784d6f08d

Download Submit