b31c04b4999aab8f95f03b3edb275e85b6c6fa08a2ced338e508cdf3454942a2

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5abb32f07fdd4a495f8ed05850064d2_JaffaCakes118.html
Size

145KB
MD5

b5abb32f07fdd4a495f8ed05850064d2
SHA1

49c062fbe5f5eea003652e702538b59ee3846b30
SHA256

b31c04b4999aab8f95f03b3edb275e85b6c6fa08a2ced338e508cdf3454942a2
SHA512

7a879464bcd379d2bd6267ffb583f8dc2556452d13199a46d60d01cef18afbd22e2e53f112d9de6364b67ff3acffa67b8ea9360648ecffbadb4067b7b46b3d3c
SSDEEP

3072:5B3sFiu7pcO80B5wKjgYikmI/nyGFd9BI+qHret0:5B3sFiu7mAS5EFJTqb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
1392	msedge.exe
1392	msedge.exe
1608	identity_helper.exe
1608	identity_helper.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 4916	1392	msedge.exe	87
PID 1392 wrote to memory of 4916	1392	msedge.exe	87
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 2808	1392	msedge.exe	88
PID 1392 wrote to memory of 4200	1392	msedge.exe	89
PID 1392 wrote to memory of 4200	1392	msedge.exe	89
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90
PID 1392 wrote to memory of 3464	1392	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b5abb32f07fdd4a495f8ed05850064d2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,17846981763807412730,16638581023717048871,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c48e579bfdfc8ef8dddaded387c011d0

SHA1
e941bca333feb2ba771fdaf8ebb7f24d38e593cb

SHA256
afdad7c417d49f637aad3469b2c5f5ada0bcf066a1902113de7d5d93f163f839

SHA512
da810605698b05160b5a74de677314356824bfbfd75c403a61cca5cc965b1d68946e2247942168db72d30631b54833a311e4e192c832248ad3df15848307b7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
7a05620423f8515342958ed1d8147f5f

SHA1
2328fb0b375ddf86b2ad4ce601b2ee7237d14988

SHA256
9140a44ccdbffb85156648025ae93a35e8b5772f18b2914f4f1990aa3789bf97

SHA512
b1d62eb7666f414fda8306b64ff299fcb60367faab758c9219006e6d642c503488c8b60e726ca6f2bd1363ffc0b785b9ab183ebb6120209ad0ef9b5f0593ea97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fd7e77b52bc7c377e928e48f21959ac4

SHA1
2c47c7d908b568afb033b908f6208447c79be41a

SHA256
e6ee35e8d8553b26a4e28706e3b56cc2d9920db118671ea45fd990e4b190f430

SHA512
9f650242b9b8b2019f4bd7e4ce23083ba2ad5820e4a121125ca81e7e65f43fd8cbd6762b7f6fac47c95e3a82607e5c90175035c181956541bddf98a92c7ece02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
89cdc7a36302a11344f72edbec74ab20

SHA1
1499f3e2e9b18831d0751621de3472a967168636

SHA256
a41aa9ae28d4ec513040866a3f458099d05db80a7e416f4058e79439ba2a0c89

SHA512
d1c5eade160a9181f20a2ab98f33c84bede30e916858a9268a78b66e8bd51952b9fbad95c78c7b1889e99196ba5917eaa28a493f5680307d835775c739ebc20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca4bde9bf2cba658bc3ebfb424ea6a4e

SHA1
358a12523c83fb5d5d0e6d173018a1434eda9394

SHA256
4f2f53e889be71bfb545cc9e6eddf565500b51c80398fe380c15f047f5295201

SHA512
4f08d2b55de310a6391d0879e2db2d9cd2cf968550a54824b3a167ce0e3bc5a77506b65d409fea1f4a8578c72a703f1a62439ef8012d0e955f19f7b4904b999e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1be1775f0b91a7bdee3bb63a4660508f

SHA1
b92489ecc3fc5dbf0cc93b937251f802ff77aeaf

SHA256
225aa9e428826f0e3708fa4736c6ab48c1cb6827f331124d012151f1b9ab23be

SHA512
37a08a741704ebc6ccc57a8293e7a3ed8d05435097175925596e854826e7c801c4aa0697d1fe8ed38d29eb2a00a1601d8ed3e3ecb3a39465b0995d6f056eb1d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93e3c4717158ca0252307e9dc8d4f530

SHA1
d1510f313b633e1ef4dadd590ecc8f346998cb6f

SHA256
8854fcb77a5082ec9851d91ac8a6f840080716ea2db498976aed55cafad609e5

SHA512
9369fec12e5b3115d1fd016da38ca26686a39f010a04963346cb312c1750eab45ec154d8fa2dd1d800ac0107fd69bef88ea47081c06eb21bcb91f9d3c2c82544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0a14e61d272b5a5a1eec6024433b5221

SHA1
d071dc77921aa83512b93c793b1212ef0348a767

SHA256
09cff4e27e0bdb86f9435088585081b03d8adb8fbfde6282b39788416e8b3243

SHA512
a5200ed59af314080a60596eb232e238c35e36535e6999ede1835decce49cea2eed5bece18559857070d6f35864d4787c38cf972adb57778cb607a020686b0a4

Download Submit