01e0e727b76ca91655f244e409ba54f0fb594b95766f3b6aa0ba59d2ddcc71c5

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6981da0becd92285b1077180d6804d33_JaffaCakes118.html
Size

113KB
MD5

6981da0becd92285b1077180d6804d33
SHA1

2bc713f20dfe01d38e62890e3ac5c3f86971ea71
SHA256

01e0e727b76ca91655f244e409ba54f0fb594b95766f3b6aa0ba59d2ddcc71c5
SHA512

c75bbd98ff1e9934d2c458b2691f0aa7f713c72854e1e3a0eee3b165f0f7384e55b42550ad09daf74a7257c06157113a2ecb1dc3649c105fa2dbe42bf16e167e
SSDEEP

3072:9xjUavckTwW24ZOxcaZMZ4afirporwlGl62jHX2w:9xjUi9a2Fv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
4712	msedge.exe
4712	msedge.exe
5584	identity_helper.exe
5584	identity_helper.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4788	4712	msedge.exe	82
PID 4712 wrote to memory of 4788	4712	msedge.exe	82
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 5952	4712	msedge.exe	83
PID 4712 wrote to memory of 2372	4712	msedge.exe	84
PID 4712 wrote to memory of 2372	4712	msedge.exe	84
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85
PID 4712 wrote to memory of 1896	4712	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6981da0becd92285b1077180d6804d33_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15118996707873528615,9739779666780059471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
97fa75b1b4372eec008fe04c1191f5d1

SHA1
c764edbbd3d9f68eb79907c054cd2e0f9e475948

SHA256
96107ffd4475f70b35050e9957b45b031adeb30a7d5a970c9a0a8e1764b2dfeb

SHA512
0c71be46054408a105eec6f504cac3170774177c77f107d7f730842c1d0b1a97d7ca15bd18e10064250c3254a0ec75944c78e84f38a3e435e5fe0e90e2f5c1fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4d9926846a864f840a27f025d127a636

SHA1
a96bc64046119581308335cc1b8ec70943d2a298

SHA256
93fa7ccf87cee07017efd8eeecea858adc00a2ee81a1f98a58c1d1761cb0a038

SHA512
3bf707ff55e2848fc71b8460f99f208662377769bc978a35176b70e7b7d46eb7ed3a284161d33f2380ffcf8abcfa63a4f892f63c6f41014106d528f6eb898fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ee7ec91a0720d1c2d275b25d365911ce

SHA1
a1f1fc375773d347511b0a358371d48b75990497

SHA256
111c18f452d250aab0ed98c537634e4799a27af9338954856c79ff0793d624ec

SHA512
363f7db3ac09071c6549413e828744d74685f7397b98c4f44b05449a3302f2661c23430b3520cdb16e4b22cd958dd205ce0caa8bb0aa7e84b3da2883b86a564e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b228046fe393f672b989dcbb1c27ddc7

SHA1
264afac3a9149b4023c6c3b6f0f6fefdb92a89df

SHA256
5dd127d81b9af09c89ee825e78f26fb8df12a224174cd22d2733994307578fa6

SHA512
60a7e0e14358f92a4fa26baf958f143f3f4f70672761378975c22c559eba6df91536240da36191b67b32e01f75b450f542dfaa02c47aba3634eb4338dc04f9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7508782c95d24450c93240ba7100fc85

SHA1
70a1782fcfc391a87513a78a40ffa4cb1cd5cb38

SHA256
a3afe58458fe4c931b09acf9ed0db7746b2343d425d4082d9d2fb0b334da24fc

SHA512
e3d619ba732dc4321b3a8e09791c6520a0c67c0bda9d06ab7dc627f9ec8a43d918ca9204ef27a510d908c79b056197dd1024664956717a1f01237b9eea573cd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f9553c0dc598f3691ee0ef33ea879211

SHA1
b9eeaa8e1a70a2439b13f2a14b7c1f8b39ac96f3

SHA256
d658ea5205ffbf85261e211b6f3698bfb2d084012f8290a4ec81f1f1b64ca9c9

SHA512
de7c0282aff289d944d4805f194b663316c3e45398a409b266713f5ca9b1f40eb1609757485b2b946ccc1c27d43efdc52bcdbf492cad8bf729bb483877a9cd39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d28acca2a5f2789db709d4143641e6c9

SHA1
d824c1430461221058a7cd604e5a7a3f874c764b

SHA256
85c65ea3c66e8ef79e470830d96a79e40c333875b2b92412162dd5f0fe19f425

SHA512
67992abf32262c9c4482fa0c3090850bed0be8002191dbab7489230df2e4301877e05cfde8559a400ea2f252d379106395a739d810cd24e635a55569e7eab0d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7af1a9c597a45f19ad7ca4df699b9ebe

SHA1
cc94e3c166c4a9d89c5326f51c116f954ab1c891

SHA256
935e4ceb49325c3f0d73a75f8c6c2c9954226db166d55f23cb9a5f55eaf260a5

SHA512
cfe6993e3ea8061dc4a96bc48c440e987c9fae8981d33082d3c0825432b09a7a6e13e0db0bd1b67f03403d19dbf140ca1e4b541913b8e22e4cfcbb0280164ffa

Download Submit