6aca9a216f59e07f49e5d34ccf15593e3cc344e9a45d4fe7da1d75cd51da56ce

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d74b72924b85b52c1cf39473f335b995_JaffaCakes118.html
Size

37KB
MD5

d74b72924b85b52c1cf39473f335b995
SHA1

1b3bd66b1c636a5b8858ca0ae44b4311b2e04b47
SHA256

6aca9a216f59e07f49e5d34ccf15593e3cc344e9a45d4fe7da1d75cd51da56ce
SHA512

734ae7e5eba66d35e15af2debd0f50db51b97303ab18106d68e65497478d26523c87be2b841b2b524de9b6befa770bc9207fb7b2853c9a88589d996e6ca599fe
SSDEEP

384:TjvHwduTvmBxnx7RL23mcVXWV+PzCsBSGXNEu0:TjquTv2nxVLkVxWIVB/XNEB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
432	msedge.exe
432	msedge.exe
784	identity_helper.exe
784	identity_helper.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3316	432	msedge.exe	86
PID 432 wrote to memory of 3316	432	msedge.exe	86
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 2896	432	msedge.exe	87
PID 432 wrote to memory of 1364	432	msedge.exe	88
PID 432 wrote to memory of 1364	432	msedge.exe	88
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89
PID 432 wrote to memory of 1028	432	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d74b72924b85b52c1cf39473f335b995_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1297525434823710881,17161208883755577039,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
17f5ec58e4960ea51cecf01b6baeb167

SHA1
052248a3b2a50b234c996eb91ad4adca623699dc

SHA256
b281a58f40088fee5f918745e7128285320c713c7d2f51568ebde70087d43e5d

SHA512
7ec1ac5ec22d0c0d6e6982e38a7fcb55b80311ec4444684d19e029c78be45940d7ab179e7aaf26ff7dbcc371793d636b8a0334650448cb13754967a824de91a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e1fb40f0693d4f65ac684c7580d79725

SHA1
766faef115206d2adb4c6597e312695f0d5382c8

SHA256
ef36c00b5c25f8e01d231f4a2fc9ee8aed7773a144354749a96c832cee1a4d7d

SHA512
6b2c2aa47521f820d341b49639cc5725b90dda505eb672f4ed7d259fed67a656871dcee7c4ac8ff1cb418cc4fa91848770451c486f6aca493ed2ada27b459be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
02544052bc26e9037663ac3a5be51246

SHA1
9454009a7eb4e0c071cd44cef301b29d3f6d0c93

SHA256
b646d7ed5f7cc36a12ea88fbbab391563ff5cfdc5fdbe77ded6a3591530be9a3

SHA512
15d8bd8a80e6e2fa0dfffd53d36dcd73eb2aa3f91984800ee94787775da472dbd70dca8441f285bc036955e110ba87a04e036e27407a097cd59ab6513990e4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9508abf67859e916f6e56e673e09d254

SHA1
e413e6c8ea5f52b6cb26b1d93a9c4eafa4560181

SHA256
6aa8a46d8808f94b0dbbd1b5dea64de485c20132a1b1355f7badbb6ec0c7596f

SHA512
2881d5889bf832dfbf9883aed2952dceb7349a5c22e143506caeebd610184264e8d14e82dd4c0e5f62030b5f35a8c9b6f1204b9807907416872d31dab090b629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5979d155934b7cee8405491ee95464d1

SHA1
35c21d70963c8794c3fcdf66b1ac9d1b4dc81d94

SHA256
9269dad1788d0c3124b4bf12dbe194efe94f55722db75b15e270d2daaae63e67

SHA512
9b4bfc797f7e8277015a51510c503e4e81e56b339dda02bccd6304afe11ca68a8e3a2d6eca94a037bffe53bff9f48151910cd4b1a77b8d07d9b3edcf503db1ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d9ceae4e2edf797732bad2629a9e7da

SHA1
01f8ff2ac7aa69d20976bb854ddcf1a204d08b48

SHA256
9d6608f5c7cf453bc7e3fad1d4d17bad7421aeea0c26bef53be7a7829af4bf7a

SHA512
fd21344dce28666f9b910d58c7492d6b63160b537e2b6a085e752a781576066d14a4e1c470fe1e19981e5452c9185020399308c3e64f8e59b373b521abdfd1a5

Download Submit