597e0b0a7daadedd8dee829f2d1b22e34d51886718a738bd6b22016ffff38338

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc8e7f9600316e7f60e5cfb4c5d5334c_JaffaCakes118.html
Size

69KB
MD5

bc8e7f9600316e7f60e5cfb4c5d5334c
SHA1

55fe0d56167b685c8401b7f1b1f2f5b6570b87fe
SHA256

597e0b0a7daadedd8dee829f2d1b22e34d51886718a738bd6b22016ffff38338
SHA512

f4e93fbdb66ec42a5f838bb3683fa2d01bcfe5a858867b3af479127a874a88c2e21244915638d5cf4091f399fae3d5a2508d54f071c4a09b31402095c2f463fa
SSDEEP

1536:gQZBCCOd00IxCP3BcNZuO1f3BJKaDJHGcNLt8HQ2cqojEoeJzhBiM9iEkBR0FSzz:gk2i0IximZuO1f3BJKaDJHGcNLt8HQ2E

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
4916	msedge.exe
4916	msedge.exe
1532	identity_helper.exe
1532	identity_helper.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2232	4916	msedge.exe	85
PID 4916 wrote to memory of 2232	4916	msedge.exe	85
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 1140	4916	msedge.exe	86
PID 4916 wrote to memory of 5032	4916	msedge.exe	87
PID 4916 wrote to memory of 5032	4916	msedge.exe	87
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88
PID 4916 wrote to memory of 3224	4916	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bc8e7f9600316e7f60e5cfb4c5d5334c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd09e646f8,0x7ffd09e64708,0x7ffd09e64718
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14701336965073308795,4664387561233139680,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
38056fc9ea2f8476f557a085a25b4112

SHA1
eb82eb2727ffa08c3e7b6481bcb7f65fbb2796aa

SHA256
883f6bda21206fa055808591748df09d49e47be746ae5b77f959e47952a9ddf4

SHA512
abbc261ba2d580544847ba52a44f2c5bec1c2259cafcac966b331375c949b958efd8f7efa0eae0e08fedb34b9860a2e2f12bfc6e61582bd6c228095629cedb2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
bdcc14ebb116c47e058ffe0417167521

SHA1
c215708658f68e796f2b1c341484efbe268433e5

SHA256
5d0397abfef9a4725023b75d8430c97e526c6eb1ed1253ce5069fedaf8ab3e48

SHA512
21dfc8888b9be9c569426fe7bbab23a18be2e0429513f461eea67a81d0c3ef09ee3063b40a05a418703b5093ab93e5e6ca22a437010bcfe7c7a97eb9a9611482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
497B

MD5
41ddf1a3dc6d6e707a5527470eef3399

SHA1
7d95613f998f4f063638055470806d31ceb28eb8

SHA256
6b536e2fee050508c3a2276dedad898fecba676ce3068c2701a7615d040fb49b

SHA512
6c770fd5668afbe4d0aafbabf152630c947066c5b4732c4953743b2df77c297ae60ef4514df40ca5d8dabaa243eb5e189de0e1ed3517858ec0b93bb457b69127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
90a94aeef5e877bc807ffe8c83af89eb

SHA1
9c4ae20c7ae183056e379a64e494dcd7e3e7f366

SHA256
321574c14e0f6fb239ddc67a0020153a74643caa900fafb9fd9de8f346641681

SHA512
210fd5d7569bf9c150f892bdeb8a7ab67e06bb336c1d8045e6cf1ee320dfa98bf4c96d251de6bfdba796d37f0419794a21473af2a1f5c5797bfacb1cb44f4889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c27d5ba323f7b8cf3dc515a4b7979eb

SHA1
32d52105290503c68d8c9559451789cdaea574ce

SHA256
90ef3979fe49acb8a2b4519067dcbd99a24fb4cd22c334287f9a12c359de79ab

SHA512
5a024fe5c40e9f12dc96ccc7e7953f7edeeff8ce46703d9cf8c7edf7b2c3a91dc7653ef0c05f062d51f9e8a21d4421acbabc2ac0e3e826aad1248d56a3131c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30f9bf767ffb7fb4e8e859af14d194e8

SHA1
8c28fc8c9a33a245736e7b883c5977ee6d5b9932

SHA256
36ee1045256c26e893d41e769b8e19e41465013908d9f99ed7dbc35dfdc792a5

SHA512
8b99424b846ecadc1735247ee592dc0216fa09efa08a39b306fe5164ab0d6e6e7e952e70b0276589a542e38dfbf250635225bd68c8fd1f5e6daca2d7106287fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
9112588b692122f57f73e96fcd81b86a

SHA1
83303c4cac00d701e4576373e761a04319f5b358

SHA256
54f7e209f807c3e025b84b779c3926a02ee59754cb57133e7003cd263b584c1c

SHA512
a51b074c6a50b013845d36919507b61be3e9e13a81efd63f5195a765f96037a1d5d933fc3e01252bea93b36660e2ad904bbc6eee30eb67a8f5d2a75947208ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59092e.TMP

Filesize
370B

MD5
d4bc0695536d48ba02dbcadf74f3e64d

SHA1
e7d06091014c97ae53b26008bcd26811668ad2f3

SHA256
1c6cbbb95b04132227d891eaa1670dbd121fb09e88c8dfc343a92b3c0709d018

SHA512
c517a6400c721de38a1fb1b36d54a72223414e14d926b5d4f8dd607a321aacabe8ab8d7253fa7a411c3dd26ccc4a5fca1db84782d9e4bfcbecfe5193c5c5e171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ede409870d46a480ebdeff84c461f354

SHA1
74417516fde0fb8e7467ffb06f519f37c788b472

SHA256
8098ad89998c98c796ef8f33e70fdd3febfd2d5030df6725a9be2c36819e5f72

SHA512
0e53959d1b990198add7f25e91c8b6dda2087cfab41c32f6b759330337dfec82a0448130f1702935978db37659cf9c212e0c2f4ef8d468675b25f55130f2db63

Download Submit