7968d3afbebc0657dcb0198068e5710cab9a8a88a83ac5b1b22a395af5adc42c

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0165ca8c92f020b039dfe7e54e33e2d4_JaffaCakes118.html
Size

90KB
MD5

0165ca8c92f020b039dfe7e54e33e2d4
SHA1

44ad2059148ae5aa2198d886af4647f505a848c4
SHA256

7968d3afbebc0657dcb0198068e5710cab9a8a88a83ac5b1b22a395af5adc42c
SHA512

026ebd2f201ca6ac6dcfb503b7babd466a789596d877d2bb26bd3b1fd467d45599c5f4737b73f7ba5d133ed0c46e9560ca91ce0bc0cc5001fe5b3c433f1d027d
SSDEEP

1536:4TjuBJbqzaI9kL2/SNv4XX1A4rWV7UCiUTXPhN1crdldXIGYDb71YuhSp5owtSSc:4TjMlqO3Db71YVp5owto

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
4376	msedge.exe
4376	msedge.exe
2756	identity_helper.exe
2756	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4076	4376	msedge.exe	82
PID 4376 wrote to memory of 4076	4376	msedge.exe	82
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 4624	4376	msedge.exe	84
PID 4376 wrote to memory of 3968	4376	msedge.exe	85
PID 4376 wrote to memory of 3968	4376	msedge.exe	85
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86
PID 4376 wrote to memory of 1488	4376	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0165ca8c92f020b039dfe7e54e33e2d4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c95846f8,0x7ff8c9584708,0x7ff8c9584718
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13155983445890689098,12957163289720139407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d6a5d2afee8f1fee20ce44b91ed1497b

SHA1
857309d275cc9fa46691ad2ccc9df230aed2905f

SHA256
de5f890e3870a5227ceb8550a77873d220e5ff08c8ff64ea5911d1ba52054fd8

SHA512
bc9aad4301df32f2eebb1d6e3c7c10a98ccfa2c2d29db42cfa61fc3d4a4d001bedb0c607df517267ec61ea0658d943f8fdb3db08ef4c195c66a628d6ce0d168a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
53a3725e243e3beacce0db186b2e5e00

SHA1
201a3f18ea9df2f43fea1256991f32cfe5bf0878

SHA256
a2959b4b5eb9cd5170ded987a1a838f756a9e79672dca43fe937ec5837d813cf

SHA512
7853c4154e0e5ae8371cb442eaa4d97e9cb90526f531bdcc6dc576e8048b3e4565792b3f26d08f072bb0ff81a65ce9de11b0cbc9a06409dc1f8dfa63ecf65113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
881071c0cedd53f284b311d967301157

SHA1
8d1303967fa393954b68dd320d3650ae22b7c789

SHA256
163bb0ece0332cc7767781c856a45f0360ee53c7117db1345c627abc9c1d97a5

SHA512
a32ab1582861393c94457ea669bfb4d160672cfd20d196a49d856bbf30727158cc74dd3d5caa1f7e2476f27cb462e5c0e5e89446056e1baf143a4184266cf93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
93fd4b9e1935cbb043f11eb7bd000e98

SHA1
4fa2f087d816df51a704054ff821859fab77bf35

SHA256
d12a1587dae4c2546d03ad490d639fd94cdb548ca9a26be3761005d2e5b50cce

SHA512
58fa93b19df08a49036965b7e90ed3ce7a15638abf312dd923d9bb37228782cdb2c56f3c9329a836d430b7cfb75e4b35822f78c6c91ba37700e8aecbc8e5c37f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e529dbf86c5dab82cbd65633076520e0

SHA1
ea22b97cc4d6d0c42f4451e1e7fa06f5374e79da

SHA256
7e9080df203ec7fc3174b3aaef03b260330ab4c29a81232d80828e482f0ed6ce

SHA512
3b897fcab5837570a6aa1d1262801aba3f3bd44756d1adeeeff3ca09289faa686db1cce96f2ed01f700ad84246d25fecb448a6339ecf750be7d4dcd6d8ba0df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
90c6db790e9380427997796a7158a62b

SHA1
cef81b3a3a5f412c231cdce04aaf53ccfc20d328

SHA256
8116e6f9f5880d3ff30cfa851e905d7360554911d5221f80c8b2cdf65ff499e3

SHA512
0960374eb386e5a8964f85e96072853afb607b415e42f41500e70858d92566dfb78e9aee01c6e2d4e2d223d5bc9a45e79ec545db586e4e2aa41a4a25d0f772c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a4a252825e738b1e301fd07607bc727

SHA1
b4be5f23d6bc0be98bfa37942557ed0dae863658

SHA256
073626a491e76b7825831a29fafe8c90301d2ae04921d8a3f1891a5e9ea097b4

SHA512
24842de33e7313efd928d0bf4584f8f6739c7a89587bd8a0ab135cea0c9bacef213a7a0dd169408ce0eeadbfda199f67c26e0d6c29cf95b4bf4416541b3dfb21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b45cce9b2622d6f6471db8edd7455ad7

SHA1
9e604c29cf822e74bc7819ff46ccdd29746bc87f

SHA256
1ef32f3fe34cc191099930bae9f2a67c2614997c388bfec3c71eab37a604dcfd

SHA512
8c31556dd283548130483e1ecbd0c5e5cdc0d93b4b167dd7943d3c93a6a9e3cdeaa965c4c64d51f5e818e493af4cfdfadac10bf708baf8319cf0b1ad3259b2b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79bb06043d7d7ec118172281fe7aae4a

SHA1
a50388611061cd2b0aef8f827de01401c4864586

SHA256
0379d2d1fd521e5f168b882e3206b7f50da1b9785f98b94d618745132d48fe06

SHA512
4cde3cc255fb58cd5e1876dd54028f8c61d17b445caa1684db23a3d64371b382229e295ec0ccbbad074378152ab9b92214c592538cdc6ec254e4769af850c8ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fbe94303d76d5fd1c9613e6a595c7998

SHA1
82c7218dbe9bfbdad243167d771a3394d01f6eb9

SHA256
e69c2187826bc64190c3f37750b61001b43ead7a56660099244deb1dc9cee064

SHA512
bad49e72c26921260449807c6e0eb41156a9a2908294c3a401261d37ed71dccf39f50309547a6a2c260710dcf54e24302157e3215ae5ffa9c9c0dfe7a349af35

Download Submit