9834ac75f88272ad6729af97061c9c4eacad1bc7c050c3b5d0aba251a5587e34

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7da4bb643ccee73846112c1e147cfa9f_JaffaCakes118.html
Size

134KB
MD5

7da4bb643ccee73846112c1e147cfa9f
SHA1

1a0a3f5e77c7e101118a3b0383d780630801df3a
SHA256

9834ac75f88272ad6729af97061c9c4eacad1bc7c050c3b5d0aba251a5587e34
SHA512

c5586a2e731c4ddbb000f2bcb7d5d336e7a4d7c876a4762ff69e323cdbc02581fe6ee5f58e6de80ef94a0b9e016aea6e20502df6297696eb3633a5ce61f47b64
SSDEEP

3072:gPipoSL+QK7avm874Oqh3CTOesMY5chEKEcj:hxah3o

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
3044	msedge.exe
3044	msedge.exe
4448	identity_helper.exe
4448	identity_helper.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2504	3044	msedge.exe	84
PID 3044 wrote to memory of 2504	3044	msedge.exe	84
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 2752	3044	msedge.exe	85
PID 3044 wrote to memory of 4836	3044	msedge.exe	86
PID 3044 wrote to memory of 4836	3044	msedge.exe	86
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87
PID 3044 wrote to memory of 2708	3044	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7da4bb643ccee73846112c1e147cfa9f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4d6946f8,0x7ffc4d694708,0x7ffc4d694718
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1730492960294500592,9573431087031314238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4c115f8324be836d6148a0769820e0f4

SHA1
a9f402844986aabe1292f5fb322849b9ce3edcb7

SHA256
25bd6bf615fa15449168b78c74f02bf9ae2208897149480952e527c33f086d4d

SHA512
650541db49e8866113f54a96eee823f48d70396487640c08176b1ec6bae85c06355907ef93cc9d7099b65287153aece1cd9aa3a83e200a77ccdcf5a2ac1b9a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
fadb716906445e2396a2bfab4dfef0ed

SHA1
e6273d55d24a8ab1d9d66989fbeee52d4bc65032

SHA256
cfe6035e8e149634fb161e2573c0b5da102b40121d3a17b9a9d56cd946fe624b

SHA512
fc8e642dd104b1ed94d7e93d39e329e87fc5c5e99da4d6b928700afafa7f2ff717c1439a71a1247179c96ff71ae2fdef696018fb4eae4ade96cd5e0a706b6ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ed76789b42a8e68121bfbc7b3dfe8930

SHA1
973ebc0cbedbc8eda6ec91b906580e66c184098c

SHA256
376e3bb5f14a2fb4e3722874112bc55c49a2b10ac1607b42cb007078dbe5dc35

SHA512
0561bb92c65bfe80ffb2e246da12fcb1e9906aaa0bac8dfa53516d1808aea16f25003c612ef271ca6ab1a028ca57d6f5de37d6d2f7dd69d79036c08a14912047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51c755fb06d224e9b9c2d4773334e5ef

SHA1
b1db2b1cf3450847911c2f994ed983980e8866e0

SHA256
23052c037b132902c9722a0b55f22a9268dcb3af55cba7bc4f7379dddc6713f3

SHA512
3b664acf5d19246b6f621a8f6df905c58413b03681ca8862bb6541e6068ef320a817d0b767b50e5a9588951a8c370d7c85356c2252eaf25c6e3fee4217c3cdb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b813a63a25287b95446c7dbc184b81ea

SHA1
bbd00dcd5a21c77eb0e7b2074a9da8def5b84f02

SHA256
98d1174f01342ad43f810c8d1bc1ee5a3e1056097a8561c69ff7bef2140be690

SHA512
273876d847852366c74420eaa642e62477aa1838455fe8c4ff37146de526a600dfbf0446d408b09baafc63f7ae502b112c2f0a2a97f4d3b0a1763a358d322309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7ea50113d46daba34ff28768eeb6838

SHA1
f3440d84287eb8ea9458d35b85da562faf6ae3f3

SHA256
4b9e68eb5bc1359401641239327144ce864abe25011f60ecfa558e59a0bae40b

SHA512
2b7305318b06d2057a0a6a7e585a56d88b5939168e43386005c33ae3d4958226c832a47f57d1ce514e36a5233a365a47db33c268947704228e76c91e467ad6a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0a0e254e7638a77b22bb0397f2c855e1

SHA1
c8d5b5459f259fa7b1414e0fb6a9c1506b9bcbf6

SHA256
21960e65b33d4eb24de2832749b7b6e302e4c0a4f4dcfae5a5ae08d87c13a7db

SHA512
b113be00a0185cd9f65d8949bab3f9f5cfa4705e7b3c59897384d7bd792926029965f32e27d1c63ab09060cd0d317422226eef539af4e3f5454e4acdadaaf30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b767c54b33d122d7a2aeac810f8385ee

SHA1
d47ddf01d35c33ea1b447074bcb55460c3c05c54

SHA256
d6cbba3a839b1bc8fbd56b1f90b9f3102d596b3e8258551899cd443e92003ff2

SHA512
8c9d0ab4ebd570230b38c415f1c6582087ffb857a242bb41ce04bac79972e0f58ce8e18606bfd88f8e3930bd558f44993df8dd16b70b2550e49430f31d52803b

Download Submit