b78647a1748ef446b3c270b8bdffd7c99053adb3431fa8bf015780a0d2314812

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ea0308ec35fa2c3be23785bf7824ebf_JaffaCakes118.html
Size

175KB
MD5

5ea0308ec35fa2c3be23785bf7824ebf
SHA1

114f3bb7783e9ac5f589ac368257344b4f6c1bfa
SHA256

b78647a1748ef446b3c270b8bdffd7c99053adb3431fa8bf015780a0d2314812
SHA512

bba9ff76b1f7a0b46cfc69d0b32f104552ad2c1fcd44b3a05248b526a323f0aca22758f2641533718a719e9e264863481ea4ebfe8afd30d3d11a0acccc4c5fa1
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3EGNkFjYfBCJiZl+aeTH+WK/Lf1/hpnVSV:S9CT3E/F6BCJiYB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
312	msedge.exe
312	msedge.exe
3600	identity_helper.exe
3600	identity_helper.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 216	312	msedge.exe	84
PID 312 wrote to memory of 216	312	msedge.exe	84
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 1208	312	msedge.exe	85
PID 312 wrote to memory of 648	312	msedge.exe	86
PID 312 wrote to memory of 648	312	msedge.exe	86
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87
PID 312 wrote to memory of 4756	312	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ea0308ec35fa2c3be23785bf7824ebf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8517946f8,0x7ff851794708,0x7ff851794718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,11519337516520796502,8073083254683503686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
46KB

MD5
f0d81b309d4441d6dc22bdcb9e9e7d01

SHA1
77e7510fd01735991f8eb242a8a20acf5c7326d6

SHA256
90b890766ed0dfc173b119f625e4bde7785d509a76d27354148bf0a80a09889c

SHA512
79d3758017eb11ff478e0c258405aeb66eeef77b6041689708667948c85c1ff27688491eb8fd7efba3e5d392e299c055b3ae54fd212a0f5caaca3d91c425829e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
19KB

MD5
aaace359b85b7b4a2c7327dfb7beaa97

SHA1
582d8a59ced081f5fcda3e35721f8a3464927a74

SHA256
ed67895dc54bd5d6b94b889380288aa1bd1efbe14dd06ce4fa63794002994ee1

SHA512
68b908c77fb16a195cccfe531060ff7d5e0fa97bdb58ac860ea5d8c0f04e49ab3bf906839a971c4208360688153c9362e81054124f88d2dffb4101a065de1f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
95KB

MD5
153d60394558c87594c259c5f60fca0f

SHA1
fbf6d8173b162b87def7a81b5beb4eef4113ec10

SHA256
c0ee0a1125398bc5952930082120228ca070aa5b386626d41e7e97998688db21

SHA512
a836663dc80c0f3b8686a2edcb77fc54187f2c7079afef65165a76fa4aa56e5484bc75a1c219901f141d9a8dff9f282f6cf52b4e63ab8773d2a0c82d846e0623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
c797bff2aa0fa7f0e312ddbef4133e6e

SHA1
13466b4fb240abbd0114824810d85002f2f49578

SHA256
8134e6917325f600daf71031ff2cc4f74e68529615417fa5fa4145772059ac02

SHA512
cc5aab35b8a9c73d3c8daaa2f0a52ea5e5cad2e759a48bf4e876eef5cafab1840b4be28f65f5ea4ac3f4c6292ded8476475da9d6f83c53e25eee6c1ef6802055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7b86223d7c4dae9ad22859863de49459

SHA1
92a91e7823ac50f73ca8cb94a3dc4ba800335704

SHA256
f7858c189228b9e5851539a0f66a5ba3176479dc5c26e7de3d5e07043faadddc

SHA512
e4dce3035010e5890c1ef59a79c516b3e993154edef58e6d5a5900611e7d894311d96dd67da113ea9dd23c61450a746d299b488c7db5afef4a8e42e0455c85d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e9ee3602a55dbfa4daa9c4f45f76c65f

SHA1
be2e009bb364208112b5b88db4b883518de70bad

SHA256
5a3579894d341fbad34ac4a664b6022a6d9c2f20f9c9da8d209784599da038a0

SHA512
405c21dd8f5d1845735a17c97e20359b7d4baa56639df57e2c06f154a31ca0aaee40bf93dc70c61aa8e19c0ae68880f439ae71601f15d4234bbfc4fa212e6946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb9a55fa4cb350f932567d423ca19a12

SHA1
c0c7502c86f58046457403c09417b6e3f37ed1a2

SHA256
20c9715f0025dbf62cb97a4c384de6641b047211702466d730522f49b3d3759e

SHA512
635b265d7eb09a7dc08c06f3396ed69c3efc718cd735c19ff86805f25b76b4ae39622bf4549dbc76f43574f549d647201e1baf259627635394cc0c8ad8a60528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d29d65a901dd1f8a0a018bf1221ad6c

SHA1
eb088b22dec65b03d639d15560314fd7b944495a

SHA256
6699292be33533a3ac826fe0d5b2318cc2f43407c6d5ab00c9fa72de55bb0942

SHA512
6b30351506a88637e15e535d59dcae2af39906349056852b2bf1b76641188fa88b66d4e5315d62e3684a1086b399ad54fd1ec538465b25dfa5dd3d216b2fac1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c972e10db9c106d597367a0bda15664

SHA1
1c016c074d5395f1c058379f9c9cc67307e7e3ea

SHA256
63868c714b8be30dc48963e826670900e1541260c73ee3c4a1c885456a0a4497

SHA512
102e03ea32e0c18c7c833da7fcb0d79861cf1ee415aa4cc030af7a555df598caa22cbc7f1e7c3cc20185bd5488b73b57411c8606cbc93917ab781f4775e1ff02

Download Submit