b6e048122e6faa6a89c6fccc25f8fab8167671a963ff2f3191b422b1493ff054

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7114b3ed1244d3e7b76187bab896b417_JaffaCakes118.html
Size

175KB
MD5

7114b3ed1244d3e7b76187bab896b417
SHA1

16a0300d2b98b47e4bb9aecc0610dcbfc83057a2
SHA256

b6e048122e6faa6a89c6fccc25f8fab8167671a963ff2f3191b422b1493ff054
SHA512

daf0a65569587131473f647da03b6bb0be01ecea3f8c72264251891a957e991b8fa25d76ac9bedbff3ba721fe6c61f8331f1950a81c18a8f37533bf0063f95bf
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3FGNkFXYfBCJiZ0+aeTH+WK/Lf1/hpnVSV:S9CT3F/FmBCJiDB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
4368	msedge.exe
4368	msedge.exe
1504	identity_helper.exe
1504	identity_helper.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe
5292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1020	4368	msedge.exe	83
PID 4368 wrote to memory of 1020	4368	msedge.exe	83
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 4996	4368	msedge.exe	84
PID 4368 wrote to memory of 2336	4368	msedge.exe	85
PID 4368 wrote to memory of 2336	4368	msedge.exe	85
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86
PID 4368 wrote to memory of 3520	4368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7114b3ed1244d3e7b76187bab896b417_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850fe46f8,0x7ff850fe4708,0x7ff850fe4718
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16124738244514111995,17786477818271810572,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
19KB

MD5
16c0a2c82dc0ab50f23123f7ecb11f51

SHA1
fbaef7794f352126af25aedaa99f1bc22d131f71

SHA256
5749a98e9383a271b4f6cac8caefea4d86a6b40e203a750d45fda652e167583d

SHA512
0bf3c5458b647601a1f28c194ac1bcc424ecdeba91871fab9178e8daf1fdf2ee956ba55bbf61b3cd2f54cb1ca008dc894e6a54730f5caf754c61d9ba20da8244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
04b0a6ae60f24b5135c0c22ae46e473a

SHA1
34ac443fbbccbf5a39469ef394634f44bd83468c

SHA256
d4b6e9fc4c60df260455b85add602fd97d9b605f925e029e8b456c87f109d1dc

SHA512
a4a55dc1eaac3a9c61c3b6a46507a1bd15e1b3b3619093e144545ddb9d6f90e3a50f2e7be673828e9fa4cb05c4ffdaefcccbd478ed3940db71f43d7fdcf1622a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ff2d7beb8ce35491e1845dc319a0f43d

SHA1
b0946180b3bfe257865dd5307d96d66774b42fc2

SHA256
e0a3d50f8fe46a760c30dceff867e55b9e35c14f8a675155442d6dfcaf45efed

SHA512
bcffa099816d1401a169e0b7651148f43639e1630af42643058782e28f60df9bffc0dbe753e4e5f4feebfd533f0b648cf3493d6935dc80a5334a8bbd95f257c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5e195dd6d7e8abfed49b664447a195d0

SHA1
e8c63ce21dadb72b4bcb82927e86ec1b61c0196c

SHA256
e6163b334dd5db4e3659cccd0ebc90c09362f606f54d2ac30d2b314f2ed9707b

SHA512
56978fd36c374fbf219868aed25190bc39e5779c11cc03e3d43a07a174eacf6eb7a8cabcbad68b9a5f12c3c8d73e9ce7ab2af584ad0639181accd170681acb49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d7c98130a0a5279d114c334475c3a850

SHA1
17241b9974c0d5fc016da7d5092825008307f25d

SHA256
3cdab8912bd5d5bff01d8038bc58f83006364ebaf6a653f76280eba22f718151

SHA512
33e7d95ad52756662948f7402ec9edade3bcb6dc9b95945bc6017821a3152f17dc89b2b8f25299c77a6eb8bc0b2f7ff4f489c5704de070d3a52c37c20917d84b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cae178938b53406a0bdffb7fe2c4c461

SHA1
52856af76fb8d8b6d691c25c0c874501558f359e

SHA256
94c3c738a1dcd6c66d232fe86388f0b9a1998b10960f613d1505aa46ce9f56d6

SHA512
d42856a32cf5df7dd7d249cb23a36cb68d5e4b56a362be6a548d62ef39125d2cf69fbfdc4eacb278908b106dcbdb62f80bc0304db3f32d1cc8430e4498b9461b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de48dfd5728dd1efdd43f68e3b4e2eec

SHA1
97fbab472b9f550594bb8a198ac75c0501ee916e

SHA256
2f8ebe6c56afaccf02fe6f14a882ca7c242f9a791c24a3ae5dcb54be0b9bd0e4

SHA512
b2e43f78bf2aaf2e1b25dcfbee327b60b44e2d83554c27df3edd8269d975ba02e3002daa5864f0c2ae6022a9a182b965ef41dd84157c1b2673457f35a76ea02f

Download Submit