c79286ca03ef8d007faff4832b0d8edfd30f84c1e785848b9cdb736259551a46

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c4febcd0d25b8970949338478052071_JaffaCakes118.html
Size

80KB
MD5

3c4febcd0d25b8970949338478052071
SHA1

1162dc5a7286c5596dbba62a148730fd32308509
SHA256

c79286ca03ef8d007faff4832b0d8edfd30f84c1e785848b9cdb736259551a46
SHA512

458b65d79c6a3f0fec3e97a1fc5093db13fcac7c1b0ff700fa4ad8a55ff2050f788b78b61eb02fe31810d0b61689b3631c9d763cabbb5277bd39166f50adc2f5
SSDEEP

768:EirO/JDG3xsf7nJP5lWao52KSYggnqagmotV7Xz2UbjgKqv02v0JbiXDjOn5f4TY:EirO/JrfrJPia625ULobRpn4yhbsSDzL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
948	msedge.exe
948	msedge.exe
3752	identity_helper.exe
3752	identity_helper.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1920	948	msedge.exe	83
PID 948 wrote to memory of 1920	948	msedge.exe	83
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 2400	948	msedge.exe	84
PID 948 wrote to memory of 3424	948	msedge.exe	85
PID 948 wrote to memory of 3424	948	msedge.exe	85
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86
PID 948 wrote to memory of 3020	948	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c4febcd0d25b8970949338478052071_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff994ef46f8,0x7ff994ef4708,0x7ff994ef4718
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7318870046805661365,10267711409961469409,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\702925fb-1564-4202-96c5-86b5bde58a2f.tmp

Filesize
7KB

MD5
08a4684bc985e88743efb02d830054f2

SHA1
91048e110db7c3131781fa7e79696a17804f2e02

SHA256
a852899c1a29a8405a92b36809d0d0d87133c30ece2bc795f54cba21285da107

SHA512
f70efa861e7be7bf20be48d36790295370d54b380c6e85acdfa1e90cd56e33e964b784d085e1f2b5fec5024bf9ac733dfe0d1be153d45234683c3bf7f7a66fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a152f63-533b-442f-aee4-99f1aaedde8d.tmp

Filesize
7KB

MD5
be58831d5dc5d27eceb973f58530df2b

SHA1
aa5251025ca04bef88f053c5a82c84470b8ab7bf

SHA256
6393e6e46c61dbd4a7fc66977a4228156d2412eb6abde794b667c4cb08f25486

SHA512
22deb4a7cc07e262b5f73fe7db85b4af7be5e5b1706342d0984be4b53e8a29024cd4ba69b11292367cc1fdafc1df833db58b390932a405209472e72c5d16cb7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
18450d6a7a57fba05d13d9aff0e83e2f

SHA1
4bda246b63e65e8334adf784db26773ddb03b48a

SHA256
c2b81ae6d93be3d6cae02bda52436302ba1dddadc1e7293743ace55b621b5a96

SHA512
a4357d16fa41eb768ab9f344952c5259fdae0dfefbf5261905098a5cff259ba2a10a6050eedc6bd7af20b8541750e9d791876d0261185b82da95787256880724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
719a8b2942cdcce1507b0ce71ee74efe

SHA1
d78a9d447be054eb18b32d5afc268aaab73da031

SHA256
366666009e86088ec846a0ad553e438c4273ba2223b369cff4406cd753d0e7f5

SHA512
df8122c3497cd38f30f39ebda57511cacf07bf4bc05d0f034311fe4e3f596935c5f9f1607b73304c231c75f4a2dc26bc232c4305fea4b44232e0040f5e5322cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
81f8422e6072bc64ae26ac79c09dfac1

SHA1
9d8242da9b3bb677c1842c43ff9bad4c0fcb6a83

SHA256
97d073070b970f72ee5723017c327a2a6ccfff86abe2dda193a6761b284321cc

SHA512
da5772184fd8c22323f63eebac6bc5c2035df86b71b60a7250e9f1ba50d6ae0231ca03ca3ac278a69da40ecd59e993f2dcfd92c3050c2255db2d7634c8864737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f0d9b51f6cb44a4beffce99cbc0a6c7

SHA1
62a65d7da00c7314b45efa71bf3b3a78a3180d4e

SHA256
6bdc44acef2ff0045b679d83c647029a6484ed49aa096e6d268c48e0c2fda282

SHA512
44dc7a412f665322988ffa634fe6774466d97d01b5a57ab16be17b76fedf3154ab2b9b7f52edb23cdd4f00fabefcb29ade7b8fea7f6f5bd196c67312bbad1b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82c039e32e37262d36eb632b981c6f31

SHA1
ee835458290f96a35d997b509f5fa3588a6ee370

SHA256
6ed345f8b6c2068885833c3975a70d00e6b1f9fb62a47ea9bddc07a92c56bbce

SHA512
34b8fd636de5248c3459df35e64bc727d570feda3ac7fa836f474fb4f9e3d56fd9503ac7d7fdbc29b88d268495aa617e192d6cb7f87a4df03271fe66a96da129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
49f8aba4fc7059841de5e9a163abcc37

SHA1
5e96948d714a14452c90a7fb195fdac9b19700f8

SHA256
ecd1198599e2e5e921ffc448ab4155ad085f20400b217f6954666ecff232ae0d

SHA512
48932f2d10031a36f53b791c84623f2b3cf620b9f77c0ca1c8d4088682328023c3dbe47f460327a54b4eb156b0ab383d344ae19e3014424894ff2fe2599d3ca3

Download Submit