10b5ed1d18e1ae265e18765c36f6ad85cf6083139ecf7f2c2120d0e87121d127

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80f47a7891ef639ef120ed090204be33_JaffaCakes118.html
Size

76KB
MD5

80f47a7891ef639ef120ed090204be33
SHA1

769090eea567fadaa839107833926ce4b6d40f7a
SHA256

10b5ed1d18e1ae265e18765c36f6ad85cf6083139ecf7f2c2120d0e87121d127
SHA512

85151baee209854fe97528085b1c6c6efa86d2973c46fdacb204e9b6b27cec95dd93650fec25178660bdede60764edc76383c879b6cf4fe1d9bb2d03c162055b
SSDEEP

768:6lkDgOriWNcaSoagG0k9Q128hORQ2De6s7bBYtg3zFwN8KLtEVh29rMZ5:2/Ck9GORq7bBYt/8KLtEVsw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
60	msedge.exe
60	msedge.exe
4528	identity_helper.exe
4528	identity_helper.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 4200	60	msedge.exe	83
PID 60 wrote to memory of 4200	60	msedge.exe	83
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2020	60	msedge.exe	84
PID 60 wrote to memory of 2852	60	msedge.exe	85
PID 60 wrote to memory of 2852	60	msedge.exe	85
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86
PID 60 wrote to memory of 1008	60	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80f47a7891ef639ef120ed090204be33_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef99446f8,0x7ffef9944708,0x7ffef9944718
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1672277942979397438,1703052085843388473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
40d538497fdb8a474441e184ae8477c5

SHA1
9b66ebb4ff44bba2f5914a8e781a3a905acd219d

SHA256
7caae03b99cc393becfb8973fdd1282385d98d4d907582356cd6fb642986fc57

SHA512
9a8536d823e338c9fd53d491f589535073ad193284ff3eecdaa35b2037dd5c32834855208218b9dd11db07e7456d3cf97e6a060d6c18b24cd6988ca03c0924ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3388fd23e487c7754af9a2223145dd9f

SHA1
ffa036be06ae25e627cad5fcb3045e5a2390505c

SHA256
bef5e578e2cd2f15720ca9be4d65766f155b55484389b98a3ba667c3f56f8414

SHA512
331110963711150e3f8ecc7f5049a0a0f1aee8a80bc2e334dfb691d5efe6c0adc77123ad0ae580a6da36857d4ca54e83ea41d923b68c5ed30b0265d30ccf56f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8b7480030c5eea76720c895d28bb7efa

SHA1
acf8de4e439a3ffef094f084a43b167d2c05eed0

SHA256
63182c9429ed2eb9ebfe1d73913346be551b63c3e2b6bf2b25ff7d6cbaafd64c

SHA512
c1611cdfa0716d332eab94f1454f1b4a505e6e46bcbe94a26f30a30908bf3fbe5bbed15f2e4be331f0106e93e981e8631297e29a26268e0621cfe3f89c24e6bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4be670854cfd438e7d65b9cb14e8fc8c

SHA1
51de7600a107dd91367ed5977a7d3a74c7eaede0

SHA256
2a89fbbca000b3d2037ec8ffb63b670c05960cc2801e8daf43106cb84e496c7f

SHA512
f864e3fea179b456096c4bfe556633b7eddf94fdef79d2f26125178fc176ea65a1b6457d150a1659629282950ad12843e5e43e604cf3dbd21dfbd04c1ffd461e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c8983cbb413d01bdcf3c15cd9d5a7735

SHA1
298c3f789d9ad5951cc98f3bc44f9a2301ac7353

SHA256
27db1b5d4773562ecbf6e562d35cb74d84b726ac50a93221653510ad522d3d81

SHA512
6b1caf50e73b238deafb10ebdeb71cccfac959c5c18dfc400f950f9706e939637af0f898527d9a8474e62c53fab0eb0ca762207a2d0c949133876e7ba94cf48e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f1a37a3054ce12abf6e9fc305ce50a61

SHA1
361bbc4b392e78fef0310e9b44c300660e51cfec

SHA256
9f10bea191e6858d08e490b63238b48cf4d8de923a75559cbf2415e0e79521bd

SHA512
f17b18262a729fbd1c1732528afad36d7527a18946002d66b55588757a5e4eeac13559aaaf1f5cf8344063ca095e45dca0f513a4f11404f00c618cfabbcdb97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f8b5c3b989d9c39cdb373f57df3ab6a

SHA1
cb2c4e74f93ba0bc150bb4fe6cf2b8909995aab8

SHA256
dae32e4f662f473457801f5823ce80d7e7065adefd36697d7441f0ad8676aae6

SHA512
680e015901a5e18d26456f815652f5caa8d9ea642d1034b93d7b7bee520266c5c5d694a73fc3ea993dc063f22aec807d615306a64bd4d40f62605ccbd980f4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b206e83f9d40cdaca18a354373a4f048

SHA1
d567e991bf0d0486bfaf1056dfbe4f95d696efd4

SHA256
98b8081e98b3608a65c18831a4dcc06d7dbab336a290a3fce5cabecd931a9221

SHA512
5bd5950f4bd85066359ee1b66764f63ecc10745bb88aa9d45f50872abc21db0efcb78452cadc272198beb0ab470dececad2c3b0b1e9b0f937b639e0c010da684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22537a47ac67e6fd03ee5e2850be5ae1

SHA1
8e1d011a0c3dc2260b9e9b4175ba97133768e6e2

SHA256
7510067a637ea7b78bc21d80143e705dc1e6dd29c9f59ae70a5dba98ce3e24ce

SHA512
3cba687bb01bae829288e682a1c387d3dd44391c1df4144142dc5a2aec55e90103d412d3b9f804bee5e278999a96bcf2aae6b01bae25e5e47f8b86392627c377

Download Submit