ac4480cc18806fe433cf7147819aa8e64e7bdd6c30a666ec7376a12f46688e62

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c188f61b03f3e018cec92dde3c8fa54c_JaffaCakes118.html
Size

259KB
MD5

c188f61b03f3e018cec92dde3c8fa54c
SHA1

f945a3eb5e0be21a9b2e78efe1fab4ff4904edde
SHA256

ac4480cc18806fe433cf7147819aa8e64e7bdd6c30a666ec7376a12f46688e62
SHA512

8c41539c5a5b0edf1c7ed62ac4e74cdc6d03dc294a662b5e988326f028055ebdefbc6e4759858381615900c61f9bd837e17caed75c4668894c3fd2cdf0a8f75c
SSDEEP

1536:cD5wCePE7vbpZzbEx/cDXw68TN1TWr3TqaQtEV8wmFK:cDfnW0Xw6UTWstEqwmFK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
2864	identity_helper.exe
2864	identity_helper.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4136	4196	msedge.exe	83
PID 4196 wrote to memory of 4136	4196	msedge.exe	83
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 4188	4196	msedge.exe	84
PID 4196 wrote to memory of 2160	4196	msedge.exe	85
PID 4196 wrote to memory of 2160	4196	msedge.exe	85
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86
PID 4196 wrote to memory of 3380	4196	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\c188f61b03f3e018cec92dde3c8fa54c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8736146f8,0x7ff873614708,0x7ff873614718
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16609325201363569843,6101249303014652017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e43196bbb719280adc15ef203a84489a

SHA1
68003c2d0c36bc0a662666019483d0a108fd8056

SHA256
ff473a68221eb18568863186d59af23006f4548ef4e7e06c78a71fb1b2e5931a

SHA512
9446ed870428fe37d4b4e70eda2509bbf148310dabe6d3f51ac3db6ecc2c1a35ae432fcf3f25d1a4bb79861d6f0ed1a637b0d5226ae2e9c7f2945ae4a1a2a023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
75383ec4a46f7a92148301b258450d98

SHA1
4a068bff371c09d2b109f81d6323ef526b3ecefa

SHA256
ab46c7ba1034368762e32b4166a91e771c78d32aed46763c5bb85d7f9b52ac9f

SHA512
75372553fbe980f139d37021706625efcd33db5aeaa04fd32f8154fff54ed516c69e814f65d026aa41d464384796e5a63d23a0a0ef3cb29af1fe7a028bff36d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cf6dc3b2ce2b1aaf4f4d4906cfc82ce3

SHA1
6b929ca6a66e3868aff7fcfc1006168d270ab948

SHA256
d13019c9adaafda61ab218d42b090d6b09e8020d0da068a7b84c401dd6b2b72d

SHA512
cac8a87314b0feaebf861ba5e9b66eeee7bb195f0873f1fee89b92463072b6347d2c05a8a85e39e6ba59e0f9d9fa1b621db94d2dde47813e73c53114f79f72d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9bc167ad1d2a06669b4f93d31449a6f0

SHA1
f1ab63c78799a96e5d6b9af0c1d5461c67196241

SHA256
2e4a1932ea5e7919366a236a53fd058eae68f31ac0942f203ab8f1cca127677a

SHA512
eabf1c905a6b8071dae1ffbab9167f7e6af9d6c1c8742b049364d1f8e7309da5eb91a0fda1758654430d7c5dce26c4d5f4fdefbdeea62aecd1cd9042ae81518a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69d6d792c2fb6ec57a72bb403212f54e

SHA1
46f2592a69db5b164e133ec75a3cc5117737a2b7

SHA256
ace0d54590949fa6739cf961f257723c4bfa9dd84353cd037dd1cd09f461e563

SHA512
f5df0f3c311097ad1922c088a15249d6cf3634f2b298bc1548bcf129db0f20442f9e9077ef1f03ead8834cd9bf8006deab3625bef81af62efe2a201efbae4409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b6360c19a9a42aed105e88b414d24197

SHA1
c1321e0cc4666404b2915f2a33b37673b3d3da03

SHA256
f7e4d3541a350d1f498cab0934f0f405491bdb32c1902609e64c20ab3b64543d

SHA512
f5f4357693f9b55ae666e7187f83173013aee17edd0a89f86d9942851f2f03f09f5ec99bd9cc756c9e6f8d4d686a8a0ef1be2c2efd789016ee966287464bad91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
228a532c7315fffd8aa8f311ff75dee8

SHA1
bf31df4e2ceb7d58b587a04823e7c220e785b88b

SHA256
5b5f391ac544ab98ce96b5899343414a638de971f851debc0b3e572fa75a094f

SHA512
07c0fd8e99597e759cde4dfb319f47b8159a60c38c4541f8607848c6168ac89c9abaa5872ab0826d4bdb506d579d7670515887b90658eb439664b516572f1c61

Download Submit