1d5419c5518eaedbcfebbfd0958d6fc9063a6001f770c7e436fa393304901c12

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

857833407aa4feeced847b3e3b4ae141_JaffaCakes118.html
Size

175KB
MD5

857833407aa4feeced847b3e3b4ae141
SHA1

c214aa5200aeafe2498073904b14999ae7725944
SHA256

1d5419c5518eaedbcfebbfd0958d6fc9063a6001f770c7e436fa393304901c12
SHA512

ed871d017cb5f5fcb753a6e53ccc8623106a0d5618fb0a1c30270b2bffb574f38021b5cdf15a43166814ff828c727098092e0801ee8deed69a04aed878ceb0ba
SSDEEP

1536:Sqtr8hd8Wu8pI8Cd8hd8dQg0H//3oS3yGNkF+YfBCJish+aeTH+WK/Lf1/hmnVSV:SUoT3y/FXBCJitm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
32	msedge.exe
32	msedge.exe
3444	identity_helper.exe
3444	identity_helper.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 224	32	msedge.exe	83
PID 32 wrote to memory of 224	32	msedge.exe	83
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 3412	32	msedge.exe	84
PID 32 wrote to memory of 1100	32	msedge.exe	85
PID 32 wrote to memory of 1100	32	msedge.exe	85
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86
PID 32 wrote to memory of 4752	32	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\857833407aa4feeced847b3e3b4ae141_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4610971360857884455,4991774055446527071,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
46KB

MD5
f871dd44ae8c9e11c5c85c961f8b2ab1

SHA1
7618910822a0f2639b405e3c0b13faff0431140a

SHA256
2ae2564f74716a4e44850d845f0cca255c6c0c3a7dc0c8ee6bfca0212cc394ec

SHA512
3b9638f705f83e37c3e0c9db1205b2ac76b96ba72ac56013a6aca6f34a7a9ff3548e8fc67d2b85c9f23f8337f696baa8fab01523fb04b5fd618b130501eed47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
441228283f5fbb8bd8ab9f47bf1de502

SHA1
6757040b8f459c4c0cb864ab0ed2acf8da99274b

SHA256
4a8d9df4a443fc0b8257ef29ae25c0823f81dac22320e5394176b6c85173b51b

SHA512
f50427b88263355328f6c398f539a1ebe531fab4a28e8c9c97d3c8909ee4dd3aeac7fbed3225fa89610eb7206ef03730506ac735338973ee201b05e0dd74294f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4deef930b84ea33da46dec591cd54ba6

SHA1
7a6a23b729c73982ca4d7098fe4a477238b75d82

SHA256
aff16bb3d8bf3121c333d8ab2efd5c1700eade161d6e2aa868c3309084c2baf1

SHA512
6a186bfafbbef6e4a8086d17f6e3dddecd520f7404478bc18cdbc97b3c1cab582e89c1def94c2aae049d221d7d591081dfc18f7d8b000b5a7ca34357a2421792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6f70ce580209e004807f774e93214122

SHA1
2eddac78fc40d3558e46c7e86e8839efaf0124e2

SHA256
84a5a144739e345605e9ad41a899bf6f783deb8ef5e6abeaa7d748bb02c757b6

SHA512
1d758e794473e991ae85b2279720edba5b18f4129952de695af8e524f581573bdf42b40437dc456ee777a636580e28bd73b03af35c544371f4e4b6062cdb6bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4773ef10c08fdeb4edd71408e3b99dda

SHA1
4faace7cecb192ecbd981f509191a8349d7dd6f7

SHA256
42c7a96ea57f0753832813f763fa9bcedacfa54f1f1848c6f8f19b5c4886d8db

SHA512
149f15aa3a532b1b591febd7ac4904b2940cba95f2f6305f8a5f7fab3a8d6bc9997716d003ea01fd7c5e85a87bb01839877876507e41ead571a7e4d2ee633d5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9a95d212bd118ba22ae3d793eb3e6332

SHA1
cf702dddc351df330e77697a93b13f51caffd6c3

SHA256
413a3182cbdc7326b332b2e0b386bfd3bbc603cd300d05b69f6ff6751a8fb3a7

SHA512
3efaf32dc1eecdf8f5a842b2295b8cef2c9d49d62024b0a0b9963c5fa7ad94ee1562f5eae93862b72f0525ee6c818349f296b161c1374969443ebae1afacbdb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a14c9f48-cb02-4676-9bc2-288a0fc6ddf1.tmp

Filesize
11KB

MD5
aea29c9f8270c10c087fa645ba04d7b4

SHA1
94aa4c01cd950cc3a8027872364d8c855ffe3682

SHA256
efcd9fbd897274e580c225e28a363b97bfeeb3d5ecbf9b3ac1bd2f05ff2be76c

SHA512
d1d84f71aa047c09030d57b8639c2c034664f47eb0b41212333acdd6a8ef800a1e36946ed987f6496467544c8887671072a9c0171fc4474ce078dcc481457101

Download Submit