5be292e5cb59ec26be46ae2bf81e70db919cc5fa8d2a5b0d8807f5e559e5b041

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

239e0a0c39c260879855c26b672a5117_JaffaCakes118.html
Size

57KB
MD5

239e0a0c39c260879855c26b672a5117
SHA1

c70d96ade5ecd3779a19991f932e8b1ff203c475
SHA256

5be292e5cb59ec26be46ae2bf81e70db919cc5fa8d2a5b0d8807f5e559e5b041
SHA512

285b84dc8343c47667f3196e7f6afe19cd900ee33858da5c195ab782a543ca2f09b089eea9e910077b821037ecf383c2c7fe297dc4b0c9dd5861609e16abb2b2
SSDEEP

1536:ijEQvK8OPHdsAjo2vgyHJv0owbd6zKD6CDK2RVrojiwpDK2RVy:ijnOPHdsj2vgyHJutDK2RVrojiwpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
2376	msedge.exe
2376	msedge.exe
5192	identity_helper.exe
5192	identity_helper.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1652	2376	msedge.exe	82
PID 2376 wrote to memory of 1652	2376	msedge.exe	82
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 964	2376	msedge.exe	83
PID 2376 wrote to memory of 3904	2376	msedge.exe	84
PID 2376 wrote to memory of 3904	2376	msedge.exe	84
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85
PID 2376 wrote to memory of 428	2376	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\239e0a0c39c260879855c26b672a5117_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e8c46f8,0x7ffa7e8c4708,0x7ffa7e8c4718
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9868702049522972034,7655402812772002039,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
ff93313724647b194e499cdb79312129

SHA1
6bf79b9937f16cdac8106add497283c499820a43

SHA256
266525166ff02bb89e15f2c968a6f055612be52de8c107289ab9776cc8d91016

SHA512
3a4fa1d2949ee35c25d294151bf666ec91c647191e937d7b5db92e4ba62bafdf0ac09c2f91a9e605a5f81819749d4a72ba75b24ae91878d5f2256c22a35bd991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
69fe8bce5d2f547023801c20d607b056

SHA1
44d33aa7381511684d7dab07d1819998df70a2d8

SHA256
878f60ffd234a211469b86e9ad571fa6fc41024eac7a41c7354f86dd0c51b49c

SHA512
19d59029369cd88d5942fcd61851e5dd6136c415387c0587f12dc418057ad1c5e8814e5a4f546f44a0a64e4d3f319b5f90b985ebdd6a595b690d5f7133d66b2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a78ecc88a0d07d05e4f31f98dff6206a

SHA1
df0bb19148dd029dc424250b38d7d7523db25c7b

SHA256
0a05a2e68568da4bfa676c3f6fe73ed45a4aad03edfe69ec307e9a262b53eacf

SHA512
f5c96361a2b01dfd78f8eb585a2435b8a5afbadade2cc7fefd9b5d14c475f170434b485dc227e1510c919f41cdf026742a2053a09ae72dcc0faa0d29e55c44da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
085a91537c802152ca3d73b36cb59f08

SHA1
3ed4090de430e37cf6ef6a6d9dde415dcdfa22b5

SHA256
8f517d1ed6614d66be02fddd65582b5508ec60adc5f6e019c1332c37fd4671c5

SHA512
a06e7fe937c762008649396554c449cfea160938535d9b078bd3de8f44314b6f3882a8e3f3148cbe4a612d2c7fd0b74ab180115c3d571c2ab5b8213a35a3174f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de1c4efe8a38cc55b1686d40ab3f9d6f

SHA1
a2ce2bebf5491d34814597f6e037d2133d97b37b

SHA256
b165e13b3482ad88adacc9c042d9918198c31afd2ad44788c5987f351eb75859

SHA512
9cce844e351213e96fda9aec080dbb2b0dc8ba034e69e8a0452c80ffa284322b17d61a288948065cec0b900cb2abe0362651ccf9e713edad5bace0107f8138d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7516f8bb0c5b60a8d08907b6f21e6b66

SHA1
6817ec231943ec3fd7e248318274761a780102c9

SHA256
0f84dbdb061ab847c42b05a2163389eff5806bcf83d93104ac1673b17ba80e98

SHA512
1842eda2af2f1c00917c2392f8c14e96b503a284185a541d8f2a2ba4c3c99ef8e19b09206dfca346a2af7be43db51e6e82652ead85fda74a7036e455a8d015c7

Download Submit