e6d3032bb86b407ae95de84fa2ba3cc47318acc0280903cfc1002cdb0a2fe10c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

651c03fd9e241580a6bc4eba08143b13_JaffaCakes118.html
Size

28KB
MD5

651c03fd9e241580a6bc4eba08143b13
SHA1

e29eb66b9f25fd4db5419058853e349353e2241f
SHA256

e6d3032bb86b407ae95de84fa2ba3cc47318acc0280903cfc1002cdb0a2fe10c
SHA512

6d116b6dccc0d118c32816abc4abee0e48d5fde8fcc56e2c3ca34b2e93cc938022b3636a1a08c806915e119b8c1e53a082ef865d67904a58a7350bba4910afb1
SSDEEP

768:s1uE79IMS9+x/wXSYcEjVAs0YQRR+hcdzIamSvlsufeOETJyQZgSyOX4gwKxbpbv:EuE79IMS9u/wiYcEjVAsvQRR+hcdzIac

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
3088	msedge.exe
3088	msedge.exe
5152	identity_helper.exe
5152	identity_helper.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3164	3088	msedge.exe	85
PID 3088 wrote to memory of 3164	3088	msedge.exe	85
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2140	3088	msedge.exe	86
PID 3088 wrote to memory of 2536	3088	msedge.exe	87
PID 3088 wrote to memory of 2536	3088	msedge.exe	87
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88
PID 3088 wrote to memory of 1876	3088	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\651c03fd9e241580a6bc4eba08143b13_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4037618746303393155,15203973968677017018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5dc5796f-82ad-45c3-9de5-f304f80da465.tmp

Filesize
5KB

MD5
fbd352a544ac888a87124feb991166b9

SHA1
744fb817a196510d7cdd8e6f94b3129139579c75

SHA256
e68c181d7782e778fadaedf36dfdd509316e2d6e781347f73948ce1978a78ccb

SHA512
58e780bd72117e61ab78f60bcacba2da5ec8fe7d36e7ffb55a74cc358d1d399b3fe7f0f3083fd90fca8aca0ca2b15dd69bf315fa8a496644276e5ccddc98eb6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
a76b79fa57797761907e21b9e923965c

SHA1
392195c202e77b5a1bfaeb0731a92e6964c35666

SHA256
7963d1b64cda84fc3e4b2a83d1bfed06d915211f0faf77f27f62bd5ef1d6a688

SHA512
fd403f7ca7cae13979b4b3e6e40e1a7ac804425946fc7ae79a7e4fdf3bfa899da2c4194def735dcb2e13b69406e5d7ded2eae204baf3d7d110af25247bc732db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ceff6a6e284bbc96742348a3bf443bf8

SHA1
2604f07e6e97fcd490ff88bd7475ebfa88d7d00a

SHA256
7e9e09201c98e68f69ec950d31294ba5509d3687ff60ddac981278bb08faaa27

SHA512
6d47f4e7debab0472f0fa01964d5fdffc51279bfb30cdda2c4377879bebea79fb1241af821a8d7327824fdc73f2a37fad4e60758439facaf125338d41e03a823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
886fe0b54c2c7038b86f2b53b48e5e19

SHA1
81b25b9531a19bb3abfa8accb361fb12b2cee983

SHA256
8a646a0a72fec115f46511997eb89826c41c90f49309e5a80a207c7777157447

SHA512
927e5d7dc577f22ec1ee550f2d10098fa72ebad7d83b5368a5863a9b69528564f32c6c138c952b0703da6c4c6b893055ba9f55d3ab14aea68a3d9f725162e15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9adf10c2c8cf090c323db3935b628e03

SHA1
694cc89af84e9e3420a8eb3260f317a63e0955dc

SHA256
384501c9f2dc966025b9a619e88ff882ab117d489ac8662ce721f279661e4301

SHA512
e1821759e16103d506f752e59ac88c40fbc706117771ce65234595f9f57b48302bdeec35857d65092b682ebac9cbd129d448474123d3109750df2e35e2fd5cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3314354eeaae76ed7e55753771442d8d

SHA1
aed5193d4a8159e2366b98fc9fd59aa402d664c2

SHA256
1d176126e63930d8c37cf62ce4de04017c79e48dacd3901a355cdbeccaaa2031

SHA512
3d291663d814cbcca49171f729307f7190251d9857e0eb9b577c8b366674e6c0a2d3b65712e05f950a83f2628a608e44ba882d9fa519eb93033d772dd8fbd632

Download Submit