84b3c10dd3c036e30549cb95d6992bce1d38cb6be175bab76684c67baa7fc67f

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d79a6539329c1a8bff88357f21e0063_JaffaCakes118.html
Size

123KB
MD5

5d79a6539329c1a8bff88357f21e0063
SHA1

2c210f72c016b8774671c5c09892205c77b2b5f8
SHA256

84b3c10dd3c036e30549cb95d6992bce1d38cb6be175bab76684c67baa7fc67f
SHA512

8fa05df57e782b6c6c3ae7108bbf1b903873e53bc68b54e854b4a3323e7fb636dd2a32c4c459f98bae807390e64252a3691831a22773155a5a6069c060791c09
SSDEEP

1536:qzbi0epQ3mQMLd2MDU+4P4zGvERPsFal+KrWcRhXuTUpe19Px:q1WQMLd2MLGvqXl+eThgUQ1xx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
4240	msedge.exe
4240	msedge.exe
4004	identity_helper.exe
4004	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4772	4240	msedge.exe	82
PID 4240 wrote to memory of 4772	4240	msedge.exe	82
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 228	4240	msedge.exe	83
PID 4240 wrote to memory of 388	4240	msedge.exe	84
PID 4240 wrote to memory of 388	4240	msedge.exe	84
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85
PID 4240 wrote to memory of 4880	4240	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5d79a6539329c1a8bff88357f21e0063_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb014846f8,0x7ffb01484708,0x7ffb01484718
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11021605629914679526,7535257812419801678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
168B

MD5
f4f9a357b49350d972e1c2db497856f2

SHA1
a041aed84abaaafe835f7833d6173cb01557e83e

SHA256
289f81d5ffe36689387ddd8d91944459e99ba2c5667edb5ce4f441661986c29f

SHA512
0e4b6487bf7d20ed9132fc2b9bdf0939c8360a26b1deb38ab117fbf04bccaf7ad677a219473a953eed1b43fda0b2c7ea62e14e63d920fc2e3be6bd325144ddb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c710ff2b367dd4212723006dfe39cd15

SHA1
42e1184ffd85986b234d9ddb8de293a63adcbecd

SHA256
b20c753ac19d84bea9e7f873162bfff977681e9a6947ebecf73f004c88566250

SHA512
97933e8a704fa08796ce0552412a2ee1fc9facc80acdd88531bcf491959b2e83db7cd84e9002d2fa2703b61957507890cc7af7cb8e46e4ee973f5735330b7dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d9b6ccdce5fa952d093b751892579904

SHA1
d487494e7d02f01148e727612d6b5b050a790168

SHA256
a8e857b65021689e62086a37d0379c226286e440368433e151e03ff6d5e3a0d2

SHA512
0409a339545159e522395f0bddbdc42a4ef88e08c1ad1be6d4997d6816dd2609a82bd0d8934ba29b8ef0561410ab26624d5401d85e1e3a25b33607c52703421a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2e5234de10bf01a9174593fe4e342d6f

SHA1
68508ab3bba96eebb382ce74968a98a0aab5434d

SHA256
e6ab29d9baff9ea36e8362570b854e2ff55b31906775801375ff954ca5a492d8

SHA512
a4f901e30ccf616388e39dff3603abdfaa0d07a646cc973522a43a4c614abf8dd3ca9e56e92536d6f7a522649ad1334665db665b3ee564a5996ca7ed53ec42d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c48e10b1c08d694305ed5f46d5c3280

SHA1
39afe05ef4f02a4cc536068032168342e7c9132e

SHA256
b80d9e31f30828b823053dadbb07112c130a5c8055fc6b35ba2ce677ad36d5e3

SHA512
11f634f06ddcc55c97a82d5b1754db3f1d36ebf3c37be977ee7fec80deef7c828106058acc2710bdb23bafb20c202bf6c77cfb1c03a781bfc92abe1721a68872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0c721cffe63050824895493872308eb

SHA1
6db248a82a92723681580f35ccc58e83f9b21245

SHA256
1db020a94ebde768b40f7ce73529af45308a6ed1d90f76601da4b8554b21ab68

SHA512
cd18cbe4703c5627963f5b641832695e5f3085039c97fa802949f3ce3f14c3557da34890432191b8209a470a592502985dd7bdabc7c0fb4efde4cfd1f0b2f51c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54f35c143719985fd1aaf50ef167bac0

SHA1
5e29f3c452964d21b3418a3ac2c465cd4930e4b3

SHA256
bc1e9495a20db40f4591e25e6b13e1d6c3e2512172d46271aaf162ba3f13c120

SHA512
693e4619ab1680130e4eb93cbeeee03a795e25e4c6730cfa46a467b7a285c6f371165da6f625a209fd2467604db2989e670da4457058f6875afa2680b6c21232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
ccd664ae618e95f10a29245833f1ae8a

SHA1
aad02f3d27c32edc701498b73e5fd494c746ae3e

SHA256
4c948782f7705344d84e875e43be8bd1bf9d12fcd35a375656ece51f4971cecf

SHA512
9b4eb975a4868130d010ed770da97fe6cce8b900fd08e80ef065a5e65755af7c8616d803fcc75c8fd3fc9fe145209b0900d56098b432eec1f64e30d0cdf171d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e24.TMP

Filesize
537B

MD5
7d39ac4fccc9e5529edf3ef7b9e3b4a8

SHA1
376c5262e3caa5a226ade9858aa65bf9889a0aff

SHA256
6c84a5f33f35fae98e85eb8cf82d53068bae200fa5665fbcbe2bd510b2a20e39

SHA512
eb4e14c6930b41b7eee3acf6ceb9c9af5ae911d42c921861cf533b3f33293d03702a7b36fcde6a09cafcfbbbcdb192163190bf01a9206e53bf2bbc04b2704393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c6ce835077b1485c24c30a403934a36

SHA1
4444dd6fc3dce709648de5baeddbbf2670083e37

SHA256
2b5723f07e602381e4dd7557755a72e552b537d662a09cc93cbf3aee1b37753f

SHA512
1528b9b5c78fe9983610a25710266703f3913d6eb4e2069091245f43f2bbff358a3c27b92f9a72593bbe0c4eccf6b939bfd8c09b42f7101d60374ae8a7d67538

Download Submit