aa5b96d42743b284c59470906a809a01866f4235e135010dd30f9a2772e558df

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c72888f0fd982be1e45d74f14f68857_JaffaCakes118.html
Size

16KB
MD5

8c72888f0fd982be1e45d74f14f68857
SHA1

8a5f173102464f5d1567bf303c9b107699b7f9c1
SHA256

aa5b96d42743b284c59470906a809a01866f4235e135010dd30f9a2772e558df
SHA512

fdf13996096712081c86340ea85671e8cc6d098e2adbd472ab4036799dce3218441ac57cb3d936a62c8d384fc749c3e16dc3fc5e82589841aee75a4716adc038
SSDEEP

384:S2xOjX/6wE6KK6DBDKGxBMJzxuX3M+BSELCGDU4s4s4sr1s:S4Ojv6wMChwnjSE9Xjjsr1s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
5196	identity_helper.exe
5196	identity_helper.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4172	64	msedge.exe	84
PID 64 wrote to memory of 4172	64	msedge.exe	84
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 2244	64	msedge.exe	85
PID 64 wrote to memory of 856	64	msedge.exe	86
PID 64 wrote to memory of 856	64	msedge.exe	86
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87
PID 64 wrote to memory of 2312	64	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c72888f0fd982be1e45d74f14f68857_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc103f46f8,0x7ffc103f4708,0x7ffc103f4718
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,16293216717572212238,8893889745118975908,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
446cca32d9fe7a69b9f8273e88e01f10

SHA1
af779285dbfa8acbfd7a450bdf34eff5ae77ede6

SHA256
7a1b3214161149afce7ebef428b2127a0b181094fe0a775cb6bb88b53053a265

SHA512
775c284a7eff6ca2ac2446c3b8ab1dbde9476362200e984ec57a2dc47cf0b9c8fa9da6fd295ecf83d14802eeb76019f4705036bbd38f980b1268ec7b6bc29601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
876B

MD5
76a29e7666006033279362b106aa05fb

SHA1
2e5142a292fdf696ac1da9e8bd424c1595144df2

SHA256
8723bed306d23edca44d60ceb7b9e4abe4e6b70b09537374051c5f6ff03ab4b6

SHA512
77b4d472d5b9eb17b1a4cd16acba7bb0db3f1d0fb548c4e0dc48c8da98a13e7bcab5132793ca2ef161420b05eb964c00b206e6ecb3369b5205ae729faaa3d7cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4dde1c8f2e6e5c88a95d3a055c9b6bac

SHA1
e66a73170f44df82893c90e80a0ee861b386a2c9

SHA256
93fa4b6590cd5dc68b8f9bf125be98c22807d98b5a5354c84fd41f5ba878cdec

SHA512
8efa8f74db0a3dcd45a0903eb09275f36643a3e6a0d00995d39a8c9905fbb4d7cbf1fe47b23f374aae1a5ba200cd2d32c019ac9a9bae847b1c09091509b3d4bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d3a355402a82212ca4a5296fe1165524

SHA1
6672bc7fb94810b089e8941e5563efc97d8e9bcc

SHA256
9362ced6d7319dcf564be1e67ea6299cf95ee62814a5dfb4bf3fc8ef8a74435a

SHA512
6032284be2b41bd3bc35c72ff2fa2ed23658948e68e32073b39a7c45b9ad3de7608c799b6de0f2292b1f1a00cde2f215e93aaec1fd8ebdcb1db939b5465249b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
682790a05338ab7403adcc2db9730240

SHA1
68708b6ab974be134c0b3f9a115d9ff85049a7f6

SHA256
259c993283d6350261075a39127ae4c19e65b7f17be616c94feeb602e5fc2984

SHA512
48d9c46d29c45c47129432ef3acf586fa71dd636f1c10403c4ddb904b6694cfdea338c07b17d31845892ce061b966e97692cb838e483d952d9642bfadd9d62da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5df7f16bf5ef2d98642a2bc06385e41b

SHA1
03639073643c0a3d15b7c9944e13d14a5c2b6db9

SHA256
0500bb8ad93d4a9402f7c3c5d216ff61d4d31b232f12785f4d8e2557a4ef1763

SHA512
b38d4fbf6667a49174aff3b5bc5a96853a659b6ed2c6abfa5941250b8242b29f33239e86fff76e32e9b664123775f851e774f128da6a362df983828b39f08480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
93449411861ba0db9c1f646f9704197d

SHA1
8d256e6806462b6d46af2bdfcb7c775ee08449bf

SHA256
45f5bf9b08cf503865988eba1ec0612daac545a2864cd97d7e03801ae20a9926

SHA512
2176bf625a1b3714a1aff74393864d801a991c9ef5af52aebd6ef84be51c993da90659fe548616cf98b10817886dc4143c99a1259a745ea8c97162ad70c10040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5829da.TMP

Filesize
372B

MD5
c6b8779bc19c810903006644b5dad3a2

SHA1
b094da22dbff905f02ef07f328e5297d778d39dd

SHA256
e23972867d815d24f8dc5151c0a11247d92475ec793d2359347e16430110cf25

SHA512
d483d67504a10a02ff1fe3da8484dadca28b1749eeacb0002fa923148de5303d44555ed4b072cc5d8796124601ff2b18db836b210af1eb52dc70d05aff777ca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
352e8cdb510ac336202e1ea25ec18095

SHA1
a1785039d35ebb5410c6a0aa02944dea6b3858fd

SHA256
e69b4767e7798b017b5f3f8b8ac11ca7c0d1158af51ad98165c0a5bb24bdc9d8

SHA512
219695049c62949ac6cf03d026c8840439d6327d02191c01f67b2e9f6c4700ad3d15d9a64fd3fa6340b5c45db03b559e8c8e76b8c044c5cf7f8f48edf4d6c0f3

Download Submit