6165f58197ee04700516ad68a32192651ecc29a543d705fafba1880498a8e854

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438997b87df8ec38fb7f9d43e377c059_JaffaCakes118.html
Size

13KB
MD5

438997b87df8ec38fb7f9d43e377c059
SHA1

aa9d14cb4e0bc19dd43b3a371996061164563ae8
SHA256

6165f58197ee04700516ad68a32192651ecc29a543d705fafba1880498a8e854
SHA512

d61d357bc8e3db1c9cda57041cff8cc51139a34280909cbf805224d9a7a232884316dd06ee8c7b51041ee58d79cb23e5eab33b2dc784a39ae774882efbe0d50b
SSDEEP

384:+pj5IJmJPMSqNGGEAms5moW552f5O5uwV51fGlXYXnEKhQwH16Xjy0v9O5TZpyVq:SPMP7W5u88Dvun+BU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
220	msedge.exe
220	msedge.exe
3688	identity_helper.exe
3688	identity_helper.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 520	220	msedge.exe	82
PID 220 wrote to memory of 520	220	msedge.exe	82
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 3148	220	msedge.exe	83
PID 220 wrote to memory of 1168	220	msedge.exe	84
PID 220 wrote to memory of 1168	220	msedge.exe	84
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85
PID 220 wrote to memory of 1628	220	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\438997b87df8ec38fb7f9d43e377c059_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9272c46f8,0x7ff9272c4708,0x7ff9272c4718
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18031384639237753332,17526133647227541331,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\713a0656-97a9-4129-a8fc-cd7308263c6d.tmp

Filesize
11KB

MD5
30f3e1fa3da4a3e135d7390d811fca66

SHA1
f803ad9c51af2038d877201e15954a29e4d9271a

SHA256
60c25f5713a9bbe37b0cd08d8fe36ae12a000ca7bf33fc12dc09b830aba07b57

SHA512
783732084669795ff0e5d27c87d84de4a57e5b8093f7fa1e4fc9cf2095f8102f642e72b2104043049f98cee18ba3b61384d161cad5e0417356d1ecfb9c52aee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ddd02f3642afd9fd5eb501ca073fc69b

SHA1
9f0c27df0bdda67e5d2a36b81966a465fdcaeeb1

SHA256
abb59d1f4f49b626c4420ea4241c181a929063750357294c48783fc2120356f1

SHA512
de6e584d2e149e11f8797f353c2aa986ca6b732cd73008e5a910077e3f6e9488a89ec2013366e1eb24f3662c02fccf01e71f9914c902bc7c37add57f8a6bc8b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
44ef71eb08609e140718262bf2dfa47f

SHA1
720aecff32c9a3ae7e3e05f09688db8ff79c05c0

SHA256
0e52e8eddc39663e3c267e5b854a343157fdfe65a851b4ee3c798a2afb17e2f0

SHA512
045283fad3c2334cffecff853599dbe3fa62dbfa52ea64467dc0bffbdc1a563362956891fd305458f61cedd9d702e4f139609c40eb806a45b3f2f2cb62f035c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
51affe523f28e032e4d2a501ff44f6cf

SHA1
9a2643436caed2c0f57dae42fc69591bf463d3ac

SHA256
a0bbbcbeece39ba46c33e35c5ffad11427f69a970eff0b9c2f18f7baea388f2c

SHA512
a3ec87b451da2ccb818bdc01bab74af613a9060f8b2c444ac6dd784e0567d444e8165ab7e9efe796ddc269f7faf8a8a1ab0552d81f13459a6f472cd69a26d35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ee5e601f9a59fe17a01291246ef13be

SHA1
cd472132d492d14f9032f6665299fa32b7be8e88

SHA256
9f3c6b6d9fdc2f7303da12c4bc0b0c494be28ac2eb3e4db11a48486e760e3cca

SHA512
9ef770da2bb9eeea212c3efcdcf9533121527d82f5b8e89ab74eda0f33f38c7b2fe3f7609ac983ee950dfd7635aa4b4c27e38c0b2f402f1f14e99a67f6fb21e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb92fa0e093cbf5f6b5891b6753eb984

SHA1
0213c5316f7147bc2e46c02917d8a95f02232bb2

SHA256
b726baedcab5f2727ae2c644283ab363f4f8b15b4d972d96d4675be371fddcb8

SHA512
198b64e65a3ff9806feabe638950a63a0994a709b14d822171da7f8849533f507970113ca127e2904926c63645ef6dbab7ce720c37759fa160f626a8219710f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41c761b62c324c663106bf018f046602

SHA1
85f292363ea27bdb9d605a34df4ca62a00ef9159

SHA256
5ad6490ebb17aa6c1aac4480779c452a0b7bb83ac7e8cc8112804b8211692ab7

SHA512
b09b6571cc0039a09f0e0de506317cfbb0535bc7a3d49c1c2f07ca2b56b55177dd06306e9fcc261cdace4ed84592c4e232a082988ed3a18195dbd6cd41b8b40d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit