f70787dd22ac1860e259320c52247d69eabcb597ddd4194c5eade7cbab0bb88d

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65e714c2d3788a1cbdf4043007cfe4da_JaffaCakes118.html
Size

75KB
MD5

65e714c2d3788a1cbdf4043007cfe4da
SHA1

a6c209294692b0d5812412e9df3f4b25c327f92b
SHA256

f70787dd22ac1860e259320c52247d69eabcb597ddd4194c5eade7cbab0bb88d
SHA512

a0c29a297e499698da4aab1280d0fa7fc1127b5ae16360e271e3d9acb393345fc84ae3dc63b78a9dafb8074cd1d8183243b5c730a0f8d33249a53547f986cd88
SSDEEP

1536:50upAxXfVBBLCJNg49obnKB0ihN2VX/i5EF:5CXfVBBeJND9obnKjhN2VX/L

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2196	msedge.exe
2196	msedge.exe
2748	identity_helper.exe
2748	identity_helper.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3908	2196	msedge.exe	82
PID 2196 wrote to memory of 3908	2196	msedge.exe	82
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 3032	2196	msedge.exe	83
PID 2196 wrote to memory of 2140	2196	msedge.exe	84
PID 2196 wrote to memory of 2140	2196	msedge.exe	84
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85
PID 2196 wrote to memory of 1664	2196	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65e714c2d3788a1cbdf4043007cfe4da_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceba246f8,0x7ffceba24708,0x7ffceba24718
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2404 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1635963261018048329,15165697138983658862,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x37c 0x150
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11fde068-ff98-4767-baf4-67c0f6fc882f.tmp

Filesize
11KB

MD5
19d051c70fb1205ed94fca4b024a9a0a

SHA1
cb0d7143385236ac88ee5917dcf6a83eacdbe53f

SHA256
68e05ad0ee48d04fb6c6ffa09a0666d6d422649736eb45e6ee7195b9ebaaac7c

SHA512
e444b9783211e1b499eb8ccd35e72acef7274f56e98bf829fdf938d070b6adb0aae605cf80396e105db85154436105dec47f8fce752a1a52d3fd87d7d9060d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e06c87d03fa0d878ab285a01de57da69

SHA1
b1c08e9c1c9f092042693f86a48f243f2dc83f1e

SHA256
5148e7e13f89b08cd1025ed211aafa57047593ed86f162dfb95691605ce22d5d

SHA512
ebc06c3f02fc23dd2e8d137ed00fd12e8a7d4c818b3092dbdd0ccee5341d8486d620fafb5a97640d40e57fb80c1abb0fc9af9637067a9e092dbc08434e6661cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
77fce4a2ca5cd17966f4bf5f354c1bb8

SHA1
bc7f1dc9eb826b4b94476faa6fc176bec831c949

SHA256
398f9d7a16317a3d604629c3d89591126c429a8d90407c1eefc280f438971826

SHA512
6ced802c2b433f57cb062ba8c7d6d61818e6941811494a201effc2f05c6ce43e264dc381dfcfed75eff23ec87383c9c1e182137a50561962233567c0ed66bd69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3b2af0c756ebbec8df8082de408f0b31

SHA1
a42d15a542f9998e476cb46f9ac6fcb4927aacda

SHA256
ebff3ded7ffe01ed6b09e8806d30e54869eafa9851b905f85f2a17901389bc99

SHA512
ff032dd330a807780fab8cf9aee515861ef230f5ddb6fb5789d2b21cc207e95fbce64d031efb9aeee4d008f94238d733d279d1336678febb5f83bc5470408b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2959fc1d846003ee01d93e4e4d462556

SHA1
5596fd8c52488aea11b9086dd3a8912a5ebbd515

SHA256
9c9955a88fec05f2084a7ab6c1c98a88fdfd724f130c82488d9f6bfbd1d28bcb

SHA512
669fd11c0f4958db4bdd780a69bb5a5522821478369d2d42d178cabfe4ef2d7d2ad0412630e783574c5bad2c94c8a9853c6eb73c91b43667b41c60c2b7f1d8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0239cdb9e685cb34745c5373896dee6

SHA1
20f045ef513f930c77c9c8fccec8b4e6884af342

SHA256
1ef1f58de6fe93e029fffffffff5a6756607fca1f6d6f667646ab5915efb53b4

SHA512
71e657d5ec560690f8b46ef08143d6ccf428dbeec92ed07b6259f6e53a71b836dbf3dc21abedf8b8cccffe2aa1e0b03d051dbde5f585d6f5d2256cd70c2950f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e806251cb89aef4e9b373ef2593fe81

SHA1
c35f035122e69eae9804cb65f66955bb85f10c4e

SHA256
b34e65f53ce6fa72622812b501aa8d9f7976042e26fa32ace5124fdf8f95e2f1

SHA512
56c9b73b1bca2aac1f226685e7c4d498fe427ad8678fc728bab00c56e2e56dd55f63aa0a3b95f4fb9dff6d64815e4092929a6455475f018382df40b22aa1b3fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
720cd5189fe3b369139935cda884761a

SHA1
5edeb56b6f9c01e73149b0ac9ff76afc707573a7

SHA256
a9e314bf79966ddeda68b35ac92d0b284d8c3d67ceb3d046e797b25e1a561c22

SHA512
67f194dacf7754594bdfecffc37daf24289adbf33df3b4e86adab1b6b59243e932f3b2b815a5209bb6ffb85d3b0737c19f489e8fbfd76e24c49284cfa8266748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580cbd.TMP

Filesize
2KB

MD5
1500fa8999a6158d5a3ce9746561eecd

SHA1
6a679b8353ba0aacca52538c7e4ffcb78e8f9c09

SHA256
55495ed847c6edea248cd7251131d710b254df148ef0c38caa47b0a36ab5135f

SHA512
cc9351f2412ccfb64f031743a1fd5e7dbb8c97285f8487f8a4ef1a20cc21a6e9465ef593b62ef401919ca3780f855f631ecec7bf2a7ce80bc7e2851b02bd315a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit