a5cff059f8f087bb80643199df63987e19fc9eba90068e3606e7280f1ccb1bc6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8138aa7e554b83e8a19f3fdecde21f03_JaffaCakes118.html
Size

77KB
MD5

8138aa7e554b83e8a19f3fdecde21f03
SHA1

4c4be58bea28048ea3e3c7740f0f5219a0e33886
SHA256

a5cff059f8f087bb80643199df63987e19fc9eba90068e3606e7280f1ccb1bc6
SHA512

67d2146889a8896c79e8139495a7c5f0e021e5c6ab527e8fbb8f038f93b12da70dd0dcf383d6fc5954fb689136d900184812ba97785aa90c92337d44578db1db
SSDEEP

1536:81eQhUJqEPY905TTrNsbwL6gDreCb8JavfdZbGN4pSr9QZNC8Gy8+bXf1ytcPejv:8sQu02Y9iTT56gFb8QvfdZbGN4gr9QZa

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
39	sites.google.com
56	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2912	msedge.exe
2912	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3572	2912	msedge.exe	83
PID 2912 wrote to memory of 3572	2912	msedge.exe	83
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 3748	2912	msedge.exe	84
PID 2912 wrote to memory of 2036	2912	msedge.exe	85
PID 2912 wrote to memory of 2036	2912	msedge.exe	85
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86
PID 2912 wrote to memory of 4520	2912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8138aa7e554b83e8a19f3fdecde21f03_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5eb246f8,0x7ffd5eb24708,0x7ffd5eb24718
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3098406522281311393,7075488023765032267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
e834bc513856d0965758a948e92068a0

SHA1
3b4697013848e9828707e671cd1e1b8dbeebba99

SHA256
5a3c5416be9325bc61e68b29e2c54446e5499937a875394f2d83d330d421f318

SHA512
7b725280d0be6aa5a961bbcbcac3cb18d838920b2477f4377842489ff32799fbd1422badf5c2835e1a01ccf548792cb09e0b65d0fe2288c8e75062ba0a44b3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
57647b3489c8659c496d599f397d6b59

SHA1
5019b85c5be7da342837ba3c194bf57e2011494a

SHA256
d45abc688938c346a0d7f3e7358121616c1c97b06f49448e9290294579fc58e6

SHA512
01bc49f8e9010b892e3cea33fd7ef3a66339c13a089e9d83f548585d309bd98b6fc8cd9be44c2d81ee586bcda186b128b790a652abb3b7d42d519ec1e0cf32c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
43c1cb19aa8458ad27a14c7047ffca12

SHA1
0a2db0d0a7d7f8429c0d4625047f069fd92fea0b

SHA256
b4d399e169a9a3be8e37f964180696b3dbab6181838a47b9cfa1dbdfb4bbd98a

SHA512
ab64b653320439ae4e3da44d48386ec5a91495679b6f4c4346e79871936789bbd131c37012e77affa0209143704431dd58bb72dd3bbaf4fcc70e747cf7fa2b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2536b92386032c231b2846a445b77f4e

SHA1
8fa628b2dadbaa31be79fd4c2d44eaa3bea2f009

SHA256
78d427b0072f94f78291a0936ad6eea790efdd5a70a1307579daf944b3aca7e1

SHA512
e67a17999aed5ad3e12daeb965332510c97401762cc2df18ca38a57d01f3f609528691ddabdb49d50482538766afc4d0a85845b16b653df20a2203a5d0c54578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c55154e969ac17a8ada5adc2488636d3

SHA1
32d1f0c6389ba419c93e2462e7844f6ca4419e66

SHA256
f9fe9c51536d313963d413bfb6e220f349a306c30745ef8212a3cc60295e1b55

SHA512
a181928d7cbd1e6e0b566674ef1149248c34330f2ba16b06279dfbf09f1108a8eae5239d165e32db0483de39ffea0312729d77deadd08b31acf8c54f7eb704a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c2b2f228aace190d80c1cb429d116c5

SHA1
5e79f0092703d11bbd77a52113a4021438d2bcdd

SHA256
79d67f0a02d07535a724349099c09b57ae2aa69b5968bbdab8472d359dbcb3b0

SHA512
2a1510c7b0f5983f30ad8a5119f342224ba0c2c19913f038e777ad24aea1b429264fab8dd5a55b0a99cc3517c62e85609be2275e04bfb5342f1faffee1cd1a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
93868e890992c6206e7b940b12ba6d6c

SHA1
0f1280b5eb7fd92ec471df3978781a77bf84033b

SHA256
25086d2ee4eb6d911387ced2d8a91c5c3591778f43281c09812c3fdd878eecac

SHA512
68198f1e68e2bbf75886cef136afc532bb2955bd2c85ccc21d7ca164d9cc7ed62193b8b297270c3d118a97b9ad58beeb4fb7d385f6a313fab20f914483f4ecdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27650e0a1a016280c7e81a32207a9728

SHA1
d8c9d465e9f9d4cd547343a5251178258950b1e9

SHA256
acc29b97737e1e57742823e9c583e153849c2cc335a4bf9f55817728e9133699

SHA512
080dbc133889efa6110df5796435d4ac99168f3fbbee545c915b5e624fc30ee498439e2c4ff1220cc314dc271a0c67b4414a9137bf3bf1e74ada76180864d251

Download Submit