c1f076af201c6cc4d6546192c78c180130307c8a0fdd3538c4827d274491d4b1

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a03b189722bf5fd82b04d0891b296f0_JaffaCakes118.html
Size

41KB
MD5

9a03b189722bf5fd82b04d0891b296f0
SHA1

c146d0ad93430b9000629ef73d2b3ed18a1f4d47
SHA256

c1f076af201c6cc4d6546192c78c180130307c8a0fdd3538c4827d274491d4b1
SHA512

f5a32529fc4f17fdcec88789edb9d28bd6814bade685e559ec6d029cdfc30e3646d43fa5f04afbb1958f36a4f65ba559fb4e6b1123af90c882e90cabc0677d6b
SSDEEP

768:PsEBaggAQHzy/DZgy+Ei5x9MnjleYpZ7K3xvRjv94FeCy4q3P8xtpk6oI:PuB/EiMleYpZ7ORbWoCyxUxtpt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
4180	msedge.exe
4180	msedge.exe
3732	identity_helper.exe
3732	identity_helper.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4824	4180	msedge.exe	83
PID 4180 wrote to memory of 4824	4180	msedge.exe	83
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2596	4180	msedge.exe	84
PID 4180 wrote to memory of 2276	4180	msedge.exe	85
PID 4180 wrote to memory of 2276	4180	msedge.exe	85
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86
PID 4180 wrote to memory of 3360	4180	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a03b189722bf5fd82b04d0891b296f0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef95246f8,0x7ffef9524708,0x7ffef9524718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,13657384561937196501,13098559020636169675,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
eb035072eac7c756093c001e81626cbd

SHA1
c8523b4724bdc8d03cc5f454d16924963ebd54b0

SHA256
d294c66c7a4c4bd022dabff97cca9671668907dfcd1ac5fcf5c23568948482d8

SHA512
8287d8aa55c6877a1098f66769410d4b7e34e323bb611c1c35b1c9c06625172dabd381c6f7152406e634d853229ce80701dcdd9d674f41c5a09340090bb571d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d385b96a07aa5a707b822804177e04fd

SHA1
2601282ff7b5cf9f880ab7d438599d539be30d62

SHA256
b7dc362de5196075ec9253ace7a8b7e829650810fd3230a3b6f5d0beb2446c64

SHA512
9ecc44580d0e67820e44434a02f8a414fecff9ee1ccf0027195cdffcbb26be5f3c3c2bf2fe36223d4edc0e2409e45126e16d877b605f69bf07fe2faf760cca1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9be1e328c7dd89cc5fd6e90cd299d771

SHA1
739f1fd23d5b7273480ddc6f1b84e4cc7ef9c1d4

SHA256
69d43d3ec5e2d34c8cdea68043f941093986742fe85557922e8565896b53eff4

SHA512
a9bef3ea90f43aa0f8db2cd5e55feee3045519f9b41731021e032bb181fef5b1b6ec9fd7d881a45c10c6b2fc353dcaab0e538a66b98b68e967fb2ea742a3bab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f8e9c67527eeeb709eb281aaf1a17559

SHA1
cf490360ee9b9ffe3bc642ada25c0ceaa7662680

SHA256
ad4579205adfd9318dd061a011350a80948a8048cb44d55610fefe9bfad5ac47

SHA512
0afb8a7e95344d5eaf1fae312e8c122d335fec4987cbdff9bdbecd9225a7ffe8ec555637d0655f75d9f9ab06ae01fead2296e715dbd5ee512360c0695b9412cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d15a44b2f252e07f79906cadb7f1cbc1

SHA1
d7fc2c910041c40db59bb43a969b0c5571f865d5

SHA256
34f32647eba9002d3c5fc7bd4afa9c6629a670b5760c84141181f444d7569ec7

SHA512
8504fd1e359dca39a69145aafbc48070e5b784c48e825d6644801dbe14b700c3e7453aaac586ca5955396f901ebdaf16e20d768611cae1f5804d99f9ab3b2bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f44f0c4dc03d1bc01d17e4a224170f9

SHA1
fbe171ddada06fa3226927baae89cf6905ba950b

SHA256
49674de2773d703c20737632058c9881dbc98c54c51641add4618c92feddbfa2

SHA512
30edeefa0fda4e9f329fed8cd217e346d6b487b3d7cd9f25f24d1fbd81aca431fc27788d8c3008379b408dff66a4079905837c7f6ed86c9415ff6df701280d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
582bb0580a7e8614c1ab48051982bbbc

SHA1
010e80876eef7188fddcbdb600a36b41dd4c26d3

SHA256
429785885c42f01b08982aecf87982140c7385997853992ec3eb56d86f1ce0fa

SHA512
47373c105c17f38b4d5d24535bd4d2aa9098f3a08c2c5bae1e0555bfb5bd2a5e096ff33feb76f73f18c70e3495c96b2fb233717ace9adb0da732d2ed212ff57f

Download Submit