07d0bdce7e06f8a755dcfa673c4dca1538899cae1d52e5f638286eae18833149

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c19ab2bdb797d5c171345bfc1860307_JaffaCakes118.html
Size

41KB
MD5

3c19ab2bdb797d5c171345bfc1860307
SHA1

50699b2e8ccab55d24deb89dab323a3bb22ada34
SHA256

07d0bdce7e06f8a755dcfa673c4dca1538899cae1d52e5f638286eae18833149
SHA512

74792898e6c5ee5019df3624331b08fa89a304617a166febd957530ce03bbbbe8670a637f993d376aee22ea9415dff57cd00b893963fd6c1e72f93f96b594dad
SSDEEP

384:9glJn1a//XpMYJd5iKEux4ybKf0DPJHQNj4ghKpgxhGfp2JrgH/TyttdOYgIhKzi:4Jn1a//ZVJviKEwwNM8fJrgfa6Y3MAH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1540	msedge.exe
1540	msedge.exe
2440	identity_helper.exe
2440	identity_helper.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1680	1540	msedge.exe	83
PID 1540 wrote to memory of 1680	1540	msedge.exe	83
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 4844	1540	msedge.exe	84
PID 1540 wrote to memory of 1012	1540	msedge.exe	85
PID 1540 wrote to memory of 1012	1540	msedge.exe	85
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86
PID 1540 wrote to memory of 4796	1540	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c19ab2bdb797d5c171345bfc1860307_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd55e46f8,0x7ffcd55e4708,0x7ffcd55e4718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12969371911553731562,6107881012255028407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
485743c609b86131f9f58a403df215f1

SHA1
aab63a18e76aacbab9d993efd90a6cba6b7cb902

SHA256
a48f2bfa21c7ff93379a613a49ab6a33c6a4c1fa3211add9d0ee617dd0cd4f65

SHA512
b281c5ee7f20f632c0ef035c801fa9b55f61ee85412a1279fb5bf7e0b02296754ccf268052e76007df352839997596cd12ff817740950b42289bcd4fbe644c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d10933c97f1a2d651d56d7530de01b27

SHA1
82dce5fd6db954f24afc3a14effac1348d6d8d50

SHA256
222e9b67712da275f8a39c72e77d7e8b52514610882b1e62765cb0aba5fbe368

SHA512
7240720ce3ebcc54d09ffdfd571129cbd418a3a2a4221047f523e2dee719eac84835de26eeaba2f454d4593902fd1b22e3499ea8751469e8591080408ada929b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
312a0ef20d11e29c7909313979b15c76

SHA1
9555c48170015422acfec8f0703b9b48e0637b0d

SHA256
7a5172c6bf8266e5820c401a51cfd73a42a4b43b2a6e005c19cc63790020abcf

SHA512
d5e12a0fe8d24afcfa4a65a62ead8d79a4e97619c84b49d647c6c183b075334d7d99ef224042a5693cf2cdd71ff829297cfeac558816bec997847961f5529ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fbc6e887930f95e25e42dee43359ff8

SHA1
9353db3cdc07b176317d339b17830b767b2d2f9e

SHA256
8f547387680160f7c01230225f5d2084e9107bc7f2cf90be7764892bd2f1880b

SHA512
27855a8086bcc388529018a7baf0123e726e5ed9decc5cd2316acfdbfb217c1f03e17f32fe542e78aa2977c6ed3abc9ef6edc8c3a1110ef8afd83944eb3f582c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da74b43cc446ca928f46cbae3596d921

SHA1
bae84dbfa0fa730c8c1c7e700c08abe9aa5bdab8

SHA256
d48dd17c4b85adb56816c8c7334af881cedf6121200a641c165b943ab22f691d

SHA512
a9574326cd017b563cc00e42f0882797786018a3807d142f5379118f83f654f45d210cf2099934bf02598fa0fb6b9db69fb2a0048eae0b31ae3c4999514769d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e1b9ebe64555aa7207788aba825174f0

SHA1
7312a025b41a28c49956e924c383d148559eff0b

SHA256
f705bf2d7c88b302205d0c2a316969e3b47e399d1331c3c5d98737f0a0c97461

SHA512
a2ad87139d8490799d095b7eb250ff118071350ada965554e6f52c59c433105b4d98c865e13905d190d108e56e6683fdbd49376ef2e9956b2233212d1ef10486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
14387f64f7f2d172fbf7b488fa55c13c

SHA1
b18cd37e7a016d463ed318408a03eb74072bd468

SHA256
e45fca11dc400a8da91c1fadacc5d38f64024b22440f520fbcf7529cbddd8e82

SHA512
c4bb5c691b229595b2c6fe1518a70b0c99de66ab8e7527ec1827870510f0c72a5652e0a23d344e8918d05015494b5d065f5385a1378b1392391d4b20654c8a8c

Download Submit