77b6a6d5374a4798a6883b8e9d73199cd2f0e72d43ed245e90c93f146e703832

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

883f9f8f99de767bb4996f46af48a961_JaffaCakes118.html
Size

89KB
MD5

883f9f8f99de767bb4996f46af48a961
SHA1

878879efba553f871f9d65f58bc235575db4ddbb
SHA256

77b6a6d5374a4798a6883b8e9d73199cd2f0e72d43ed245e90c93f146e703832
SHA512

42f3ffc26338e89b27fad3dfe88a4fd9e70bc58b96bb5a9abff3d391b90eb801fa2f9b5cba9fbe80cfc3e7a77875fae251560225189ecd16a7d9955ecf880905
SSDEEP

1536:V6Ob+Zz1X5ZYinOX19tVunN+XWhdcqZmiPJ7iaNMdq5:V6OSZxX56iOX19tVuNlhuqyaNr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
540	msedge.exe
540	msedge.exe
4792	identity_helper.exe
4792	identity_helper.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1448	540	msedge.exe	83
PID 540 wrote to memory of 1448	540	msedge.exe	83
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1924	540	msedge.exe	84
PID 540 wrote to memory of 1000	540	msedge.exe	85
PID 540 wrote to memory of 1000	540	msedge.exe	85
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86
PID 540 wrote to memory of 1080	540	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\883f9f8f99de767bb4996f46af48a961_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1b9846f8,0x7fff1b984708,0x7fff1b984718
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3610895318677251317,6374367472493431987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ad4432b-8f96-49fd-92a9-9c7f52101602.tmp

Filesize
7KB

MD5
0f8d6e8b5bab08c0baf493d8dfa7910b

SHA1
fa9a271411d410354c3c76754daad9fed217b27d

SHA256
50954a31cb619fa3d94f1145aceb1b84a7369376297fdab4bec314503c285d95

SHA512
0c96c637673a2c148385e72c81b5bd962c110f787e1cd5c48da9d00ce71c4ad040afc4e23c489b7eed86ae7c80d3b9ba35401300e45effe659d3ae2f16b7aebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
87d90b1851ea61e78453fc7564585efd

SHA1
387849fc7cb1a79a6ca881b4f0dbe5adc506b35c

SHA256
9e3692bfa10d6028cf087c72024526767dee6e5a044a99f0b5d1d4cb2bb68ccd

SHA512
e5c75b0264f3748953b2c5dcc11945107911cfcfc8fc6bf93442b99f8f708478c91ea04459968f757b8476e08820bde9b7579c832412a3c532b7410ca6f35379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
80d39ebe96584d7dab18fb8172226722

SHA1
aa30eb9f5dcc5f6cbeb6fe26820fdb37b84e3a09

SHA256
88288427d8bb7dcb79c48f2875f9b98b44f343690aeafe5efefc1a974337e6a4

SHA512
f5968a92db059282de0a4d6a7392138e8ee69099e7e30361e05fdf642b24b9ac58cea9b6408205593daaedc8c25d370b0fc9ee568b581fceb46d9e8a43def5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a904f59a16d9f408829bcae012388704

SHA1
00b9295594068b348d465470d0fcc65ff440c5a2

SHA256
a9e2f45f1c9483b87ed23ca3bc5c035828fd23eb47d13c84f86a589a1335295f

SHA512
bfbb5ae2f89536bc9873d4b9a735f2f09eba61c30c2f08cc7f1b4474c90318f61d15ec998a7a47544fc2dc476783d9df36c2d44a8e6c9674e18b03da2d11177f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7cb439ef4313dd6bf9e62ecf723c0755

SHA1
041bd79aab7d1a7e3f398c1a3bce72abe47e1c7e

SHA256
ae1afb97c91031ea66b3706a7cf628b5c2562c31f4f30590d428aac9731d59b2

SHA512
14808ed954646bfe09e3c92188a1bac0b62e3af04e8461007edb2a2526bae36aaf8dafb2f03a336fb132aff88db7418ce250cdab95b8c1caef98c01cb136a474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed6bbfb6111c26db6d253c8063560969

SHA1
e343094b908683b39fdcf8d79fefe112935c31c0

SHA256
92c9eb7f6b9d732e3e8159c7f7c879f840f6afce21a6e3789cad4b54b3983f3c

SHA512
a8ca6fedf9673ab56a08a6070ee0a85e1d25b2f90a6073800d659939923edc26a4925f754f68e7f5ed6b953ddcb9113fa50084432e087638aaf9e66acee4b3db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8303f18e71ebbcd7060f58b3da645119

SHA1
94f466575ae45435dadc70419281b517c4559f40

SHA256
3338525e961d10fdef20e88681c425f3e80843286744995403bd107651ed205a

SHA512
4ee1c1756fc2a1977da3015a39dcaaf0e30e57ae41ab521eab31c6058ce3a3254c9befb23812447982327438194edd3d63b015b8614e1a3f93f7c58d9256619b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f63929330ea4db50b027ebeec8d9d3da

SHA1
c8bf81c8ec32f65b53bad2fc4d6a7a1872dc03da

SHA256
fbc775187164461f23c2e7d567d21f243f289c30d4363b147378b940daed605c

SHA512
0211756c5d653c8c3feafa147f90d0c3d6e9bc976559b8e952998f2887d7c38e4c8251713409d253e898d65be56c3a187d2814672e9d3feeaf346865f4644896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
8ca6eadd1a4cb23ff3f372c2cf101538

SHA1
46b75c6b0e58eae235869ada6ea342b72bc9109c

SHA256
1561a1b2a46cc3d42adc9bac5ae40afc448d9f86c0590c3ff015e6b7f0e517ee

SHA512
6dc068b38c48a5c111668a8c442f3187159f56e037179a683edf975a5e96c64a050c54a59983bcff645e2c9f8908dbddd3eb0cc1a47a7dc50e4776aaf64ae3c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bfe5.TMP

Filesize
204B

MD5
dfaa709408d4e3c0929e901f9949aed8

SHA1
6009b016fdafb9346b888e87e9e2be722ec584eb

SHA256
73dbde07f4100a7c11d907228394e0df7b3b6dab2edc698125538c269504a7f6

SHA512
717c5feab075f55cf063d3c3ebe1ab3503cd1431b077a1d9ed8343a0c531df70a0ef68338534471069456c52ec2d8e2a3451f8b47cf61cfa8e9326f1fd80269e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
175de9e9f0103d019d26d4f3ea370322

SHA1
83828e91c7213533e582593c74f00cebb2c278f1

SHA256
cf14a559179abbb0c699f0c8c2a93a51bd5d036b781021511a2259ff07f62e1f

SHA512
772b064964a7e4f3fcf691817505c0f1f65409a51c74d09e8c99c76dc31f978156ed4054bc2291592992688409fddeee34b63a067d1870b019baaf8e6706221c

Download Submit