242d40e5adbc6e46bd24961acf03fb6ca0c34857907647a21351ada47748609d

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4c4c823b262a001384a7bcc405b26a9_JaffaCakes118.html
Size

681KB
MD5

f4c4c823b262a001384a7bcc405b26a9
SHA1

104b5ff257cef48a112abf53523f38d04e92aa42
SHA256

242d40e5adbc6e46bd24961acf03fb6ca0c34857907647a21351ada47748609d
SHA512

5aa1451fff4e2d504bf39ce6bb956572876b113db718db4bea2b1af6bdad92f7e447ee638c7d40ac17b7718f8f3ad437708eb0c89499e9f65545215e1db43241
SSDEEP

3072:aVOpBht7dNXU9FqOFmX4iJJcU/gR7WJ47+DuVI:aVOpBHCFXFmX4iJJcUqaEw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
1880	msedge.exe
1880	msedge.exe
4444	identity_helper.exe
4444	identity_helper.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2516	1880	msedge.exe	85
PID 1880 wrote to memory of 2516	1880	msedge.exe	85
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 4904	1880	msedge.exe	86
PID 1880 wrote to memory of 2656	1880	msedge.exe	87
PID 1880 wrote to memory of 2656	1880	msedge.exe	87
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88
PID 1880 wrote to memory of 4892	1880	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f4c4c823b262a001384a7bcc405b26a9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f78146f8,0x7ff9f7814708,0x7ff9f7814718
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3759361054250631427,510270733369004314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4137cdac56dfb2abaffcdf9d6763faca

SHA1
712b17c5dbf1ee79303667bcb6abe244a338f998

SHA256
b6316f5945612dc73d5af794086f860730d88210424031c046471dd341b318ee

SHA512
83cff2c0b89d24c5529e060f89925ee285ce7f20d039a0db624a63f368193f24bedfacdeb0e3ba9a5e0fdf826b56815c394b0136466822362a68e33a63f6c15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87764a12f732824d60ea907572f441df

SHA1
0c1381fd6903f19e31c5d1080a9221f4c973f30e

SHA256
3d8b66fdaf729ec716e15eb856c8b442f4719e9a0a04d833fd27f767bb17b8fd

SHA512
ea4c9466b4295219962aac62182730e6c0875ea8da2e679083fc2cd771ab8c945fad46025a122b3269d02e6d13fcafb0fa976a3ffc8ed30c5d736be264a15e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
95a2684cb46c5c2c268751fa69e2da6f

SHA1
065d5180fff106ddc7d4a9fc73efeb695d98871c

SHA256
8dfb5395d65befcaef1edb41a6f7ff9acd1f3f922bb3e3babb8a66cbc4a3e4c3

SHA512
88ad1b9ee358f97be08e2ed7108725848872f6242aeacb63f9dd2531c79393f85c94ce84a281f7dde6d0a6a878ed66f568dc3888f1a045ad3af83d6dd8835239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
87ab67d7f29dc8388df3f59eea8d1be7

SHA1
0e4f1f239c28c39332dda6b8e7fa2a16382e1716

SHA256
048a3c89774e26605731da146a6fd1990c0fd674d10946135c870e88d6b85a40

SHA512
59f96043269b2b73f2a059b52b4c93736e3b628b22dc1940c35a4780f73c2886473180d2c4aca78cbbae4647823f3743bf15888d77551bad98120b4ffac4f627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
39c2ed26e0e93d26019c620446a75012

SHA1
9b8e50efefc885fe8d06b81a19193a6f2fca2c4b

SHA256
f570dd300aaae7b6c11153a98fc98448556b3dfaa9c8d7366f8a5f754781b795

SHA512
6bc18208f6ea562270d8516e49a74c4a06548fbd6221bd81253941f86abcc7986e0b82e64a7b6f8bc8425e65745d6e2a4d20feb62fce24204101c6967c8194fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd06b1f8684e098e03ed0b06b73fd8dd

SHA1
d31a19328d7adb4fcc514483a5ca74b3aeb3f2c0

SHA256
5c0e051a189a3b66e395cf2085cd80a4c691f2c1b9480ade74af9e67fa0cb7f6

SHA512
9138772910efa5c2eaf924714f227e739d806a68a0759ece9fa35ef25e52e778ca722494dde44c57ddd3720301db66dad8e098f2224ce5b7c05f12c370d64540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
feb7cad4d0e8915f0f57757a2b5dce13

SHA1
63637949c6bcda50eca5132642df9d6d760ab008

SHA256
27249b7a78f923a4aa7d2710cdf0e895abe55461d6d9a01b7dbd0c137965aef9

SHA512
788f3fa15e7e1fefde6bbc8c38e0f3df20ff0dd3dd0b9e312f9f726f6668b859302502aaf1a904ca4d7ac4f6d48d45f561e44dea3dd5f677cd14548acafc6296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55664db7e3e046d71329b8c051278da6

SHA1
9b90dc61bc7ca58e2be68d5f69564c4df8cc6c28

SHA256
c6d209f10ca13fd6f7f93126114aa35a41d3c8489d98596b8ce4243611796f73

SHA512
33b30cd0eee5db0967cb25cf6f205b8e97fbf4a85d3140a0d0f5964be2ad09bdd8acac9cdbb2c7e22222dea2a46cf515ab39bb08a2927c16bfc66d68751f69c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3623b335cc798268e5797287a8b532fc

SHA1
559cc8c5cd086abd2735e8e23c3c064df755ed7d

SHA256
46555c030b2be5bd797cf6cd6c32798c4e832fe1b8cff22a1eac40fc9839dc1d

SHA512
effdfe961238b293d639337779980242a1c3515f089e68a0ab76f77bbbbfd0f18d3b87f21c9e0e24a344f605bb764b3ff64d7cfbc15fe80f8daba4197cb01fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2bc93b6-a2fd-49dc-966b-901ad91d7209.tmp

Filesize
10KB

MD5
2a0217198beb8d8269066b8d7be82ea8

SHA1
40b10192468208c4a86460948f0b21ec73a7a16f

SHA256
110a7ed7079b45ffb35ab041ba26713ae7b74caaa64999392f7a400fa7c734bb

SHA512
0e8711ed432cf67a8ddad28856261275ac1c7cc3502bf0b8f6de69d4d016e530d4a037067b5fbbc4c3aef646d99d07d6391b8d6d607541b3fd792ed4c95f5a88

Download Submit