9674aefd784bd57afe675a183d5f8abb130e53e914661ec8798a787499c2732b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

511eea8f05f2ed4f34e2ca66e378ee58_JaffaCakes118.html
Size

175KB
MD5

511eea8f05f2ed4f34e2ca66e378ee58
SHA1

03569f756dc6bfcfdfbbd8aa5adb7d0e8cf5f06d
SHA256

9674aefd784bd57afe675a183d5f8abb130e53e914661ec8798a787499c2732b
SHA512

272cdec96a8d8f2c734ec6e529517114ccad8a4a2fe92edd68c63fe29e6112739bcc3663b91b556b931668628fd6b7f5a981fb773107e70edbef0d43afc32c1d
SSDEEP

1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS3WGNkFPYfBCJisV+aeTH+WK/Lf1/hmnVSV:SBoT3W/FuBCJi1m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
688	msedge.exe
688	msedge.exe
2860	msedge.exe
2860	msedge.exe
3872	identity_helper.exe
3872	identity_helper.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4388	2860	msedge.exe	85
PID 2860 wrote to memory of 4388	2860	msedge.exe	85
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 5104	2860	msedge.exe	86
PID 2860 wrote to memory of 688	2860	msedge.exe	87
PID 2860 wrote to memory of 688	2860	msedge.exe	87
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88
PID 2860 wrote to memory of 2560	2860	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\511eea8f05f2ed4f34e2ca66e378ee58_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6e846f8,0x7ffea6e84708,0x7ffea6e84718
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12404074325338086947,1609818433967703365,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
d94606424bd1a91fb5e8e4ee2a54259f

SHA1
05a89696cbc9e185514b0d749d340a7b8953dd7d

SHA256
cedf9fc5e281c9ccc7b8f4e281957ba23ee423185c12aeb958ca335d67ae5b88

SHA512
db18de53cae70a388ad339fe0c6a510031e9b516b8dc44483efecfaea84784f1b2c1b28e9d4cfcb896a99d5186faeca522a85732be225eb27923db63c196b7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
832b6e7e40c49cd47771eb34a7da2e2d

SHA1
890682ac54b916a5112a690262ffd748a74d8294

SHA256
bf755e47a60ad4feff80d03512991a0bc31ca44ab60c0ea22f5fa6b63d4669e8

SHA512
c217c8611d4b7f20c49112d60925f81ccd84c83f503de1502b1bcdf51b4cbeac0bf6fb75b89712edb7c031d664f437795987d36eaa8e6e010f871cc771997c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a29c8ab0b6f1fce00d221faefed1c4ea

SHA1
2eabec91cc3370aa7693cb659b74e93c478d6889

SHA256
5f800245416d46aa306e69dd876e47a0008ff9fb05c81677b9a36f69afed830c

SHA512
b37180129328081fc546aaa376ae5077cebcaf79bf1cd08623ced718d4efdee55e1db85d7eccec34c11697550bc3fc7668a6573bb1dbf9f4c57d9cbf8c2d07e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb2da23f0960b63c4eb239e6f51ed979

SHA1
ba5dd0a7ceef814b92c784795c07ae437eaaba8d

SHA256
cec98d2d9f9b3e3e7e8a1c0b76c825e036786178a12e06a3cdc1f971cb71a027

SHA512
1bc91f8920c138daf208564f5c54259453b3c2be25f490ccd33e37ec44d9c1cda63cf3ce901f2b542c918b80f4e88fb1bebdeccdd86855ffacc3adabee301931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03410f3802589143f328c77977946468

SHA1
3f8877e36638fb9fea219ebaa8a85d24a6712ce4

SHA256
458ebe07f255d8bc5b25f7474c2adb51f2e3dd22348f291580633cbe75be56ae

SHA512
50b5ed09e56cbe81aff29175523da9ad02c3f4c6a53da0e1ad53c1a5dad04abc9ece760ab295baf3fdcb0600ff9838555d45174a7475377c3fb8efccb770f72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43f99f6957b24adc47366c8f3bd5245e

SHA1
ba6cd7698229b68fe38e8099cee7da22804daf33

SHA256
71a992f165a80af97d7c7637b432f49dce7fefd8e04b99bb92c2853f6eec7d57

SHA512
3bfd0448bac31c91224d49676e70a66b486a1c5ac084390c03958dd771892b76981c924c5e0497d934ab10bd056102957769be982c7e8e3b73fed0d7c09182e0

Download Submit