0cfd15be72a5e54f85f6b22f06778deb58097d09535f40b7db170c1f5977eb12

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

778059aa8f6dd1d30326084ec7d1afd1_JaffaCakes118.html
Size

175KB
MD5

778059aa8f6dd1d30326084ec7d1afd1
SHA1

7d269a3dfa56bbbd556f4ef6c3c5329a9c52a6ff
SHA256

0cfd15be72a5e54f85f6b22f06778deb58097d09535f40b7db170c1f5977eb12
SHA512

7c80ac41b2b7e5f1362a62956bddbb31502f5f12de1fa5040503d120173030bcf4606a076a470790a63c4af044d404994eab80b91561b51a750e719ff125e0db
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3gGNkFvYfBCJisu+aeTH+WK/Lf1/hmnVSV:SOoT3g/FOBCJiEm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1872	msedge.exe
1872	msedge.exe
2428	identity_helper.exe
2428	identity_helper.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2920	1872	msedge.exe	83
PID 1872 wrote to memory of 2920	1872	msedge.exe	83
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 2620	1872	msedge.exe	84
PID 1872 wrote to memory of 1200	1872	msedge.exe	85
PID 1872 wrote to memory of 1200	1872	msedge.exe	85
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86
PID 1872 wrote to memory of 2376	1872	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\778059aa8f6dd1d30326084ec7d1afd1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3948210223854023190,69308607779192052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47531348-d451-4a0c-9156-41ae584f60ab.tmp

Filesize
5KB

MD5
e00517157edb4d72b7df2368ce2f3ec2

SHA1
c9c2c96224d648577f4d811d562a1e6a9609f3ef

SHA256
2a73eabc4e5e15dff332bfa72b9ff8c1ec45a54857142f634f0a1b08223788db

SHA512
1f134f49be727585be8e3ff30a4363e7cdbb5dd29864b615f4c6080b86fbc330305dc25ecab6236404eb1b7857a26a24f0edc74038a74ae3fb39e8bc7f173c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
dcd64b83baaafaeda69b8e65fd9e1247

SHA1
22c37695514ee01bedee8da158f8c50043558e0d

SHA256
125be4381dad2e205dbbd60379cdae32d82a9c002ffcd1cb753f2511a0cd0e65

SHA512
59ea6379a3c29e473d094c6598fef6f96062c244705278a8d7a26088542fa9e18c505cfc4b4307caaf15c24619230dec915726f218d0b2c55f250dba25ef1b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
299f5bb4796aabcfd1b4f9024929f02b

SHA1
a2f603123b33bb06877bec43e5bbf97b4db8c2fd

SHA256
a7477f7b779d3c95ffc258f2c0cdad73bf2697f2ed14173ab3a60afefd051c27

SHA512
0e419e9325acdd6e043757ad51bcf16c6ec247422b96864e7cdeef079930c887bb8cc0868dca62fca3c1c1a3a0e8e5b503385b3160f24a322ab235108f94ac28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
87e3ecfd6acddfaaceac825a4e33d8b0

SHA1
e4a96b3e649014136dc48c7915494e1385db057c

SHA256
d569ee027a49a4b8e03436382b4731e417bca8488873653fff4613c82530f301

SHA512
dee78ba7e0e0ccb175ba095aae2eb52394a6738708aed66613a94afd06a9318fe06ca25a2b882eae528da72c68282b833e0f21ba3818f7acc63667908679042d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b79bc7008449ccbb93509a214f10d4ab

SHA1
1f1411e39501b7c5aba5e15cc393947acc0ed4a5

SHA256
a5260c476201b6feb1b8a41a36018ca9d03db793ccbf82f33cf917408e19ed6f

SHA512
313ed626b14b292eb160ce5cec41b8bdb865ed3d23c007bebb8afa29b88e0b4586ea93f7be17a3419336d1609ebdfa90f39fd41d6b9e9efabe654c42ec168eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dc55883a7a27116cec4ce994c1a87bd6

SHA1
71aca1d7e797accba8cc3ec9070bc5ed8def7103

SHA256
5da0b0d1948411f77968b093d4857c1ab85a94fe9ae53305a65d3f022922fc3a

SHA512
e70bbbb9ef1731958c461077906fe5bf5cccbae98c8f18f44557dde67340726f6e91f8ba651532ad8601258443cd755e670305c16053f063abc348e8a8d78a6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
823f0e0d163f3f8876591ac175083de9

SHA1
b182487f9f319afef88ab24bf61f9371aef3a9df

SHA256
13f73d4f6f9d2e5eb8fc46b02ca3e6b56beec95c8d03eb897be76f476c40bc83

SHA512
a4aca7c311eac75ff5e6b52f5666df33399b6465c6dc1fce2e602ad2bc675b102659157425fab1d483575787f137b0b66c01d352bb20e9f9448ac64713517d17

Download Submit