7cea235e4ba134cca9040524d50e1457d4473dc7b826be070804d69af95b91a7

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bda6efdfd922c5153d6522964e9a2eba_JaffaCakes118.html
Size

77KB
MD5

bda6efdfd922c5153d6522964e9a2eba
SHA1

21aebd3699d03acfe7ab159a411a4255aa3357e1
SHA256

7cea235e4ba134cca9040524d50e1457d4473dc7b826be070804d69af95b91a7
SHA512

1344f233caef20b56a5c59f8bbd1b4afe936a4e3a2ef3a936f5236180a49c2bd2583fb1596d9f5cf8c492544824d05d26647a458bb21e6569b5e5ee8f906a7d0
SSDEEP

1536:sD2TO+q9oOpCORSwYnvvoygy2ODB2fnaCWd4//Fs+B4YBabffy/hl9:sD2anpCORSwYZgy242yCWd4/ds+RBcSd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
5084	msedge.exe
5084	msedge.exe
4180	identity_helper.exe
4180	identity_helper.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5092	5084	msedge.exe	84
PID 5084 wrote to memory of 5092	5084	msedge.exe	84
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 1852	5084	msedge.exe	85
PID 5084 wrote to memory of 2572	5084	msedge.exe	86
PID 5084 wrote to memory of 2572	5084	msedge.exe	86
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87
PID 5084 wrote to memory of 2456	5084	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bda6efdfd922c5153d6522964e9a2eba_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade5446f8,0x7ffade544708,0x7ffade544718
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,10096330777188496249,3591759651753810502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6937cc24-a485-469a-9d93-1dcd16028619.tmp

Filesize
7KB

MD5
7653f0237ab0ec37cda4e34e74f69222

SHA1
e67e649e268d0dcccfcc7e0fc1a92cbc1c66aa90

SHA256
a96b3b5dddc90f6a82334fb69312b0e6ea7c0a3a301a1ff0665f7ba9ad3bb4c8

SHA512
2870fba3a27f5d3cb014112bf1b020d69d5374491c6be145e2c214c0d4c8df303372c04d2523f04e3afb51abfbccce86d9f95df383df8e702f8c0de1dec883d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
dd49b647c6f579d4b49abe9fe83d5d4d

SHA1
3abadd8fd64f2ec5665db57da09ee95b25a97f30

SHA256
0ebe2ccfc3aaff2f3fd056d9c3cde5249aedd96d21df37d5dc0cf225c5053035

SHA512
bbcb88f8d5c1a6ad5e8164ccc5551fbf4e4683e801530e72bc3736b02cd235980a03034a7acb0d5224e05a7424f5e2a2a72ad2f817dc4a9d96a0a96a1f9147b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c797e7eb6f9bf4026fb4de3a37180e51

SHA1
1b975bf5731cb47dc962b23b1dfcf9064e50c606

SHA256
7118ee54e21503ee54fbd6db707fbce7ad895520d6cc6d66ee61654d148127ae

SHA512
ee12dbba525db94ae44f7d603a65674ae35e08c2c51a58576b06896784d4ffdfb7f3db57f6aa276b4a139cf0845750fb9027c782c09b4b17b472b026720d952b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
889e5a5f1b06582fa1e595735f7fc01b

SHA1
bb90f9a3fb12fa4b51265a749e46323c9261c0ea

SHA256
20b65df03d477e0e7c8a35d5ef404a83cfcfe888fadbac9dfe19250a3ac966aa

SHA512
0f628988d07093a06e3acb47930779441b94b935cc197828be5e38cfb07f6559ebb4a161f579e1a93841499e1a345567e773a93aea53c08541e1b26df26ba5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a226d6cec431cb03e95e0b5ce4576c13

SHA1
10f566807b8c53fedff7abdc391df6921d186ff1

SHA256
f772a06b8675a07a579a692962f3708b6c4beeee7f09bf0d3cb5f610ff8ace88

SHA512
e19e658635349b8794510c06b51718a6f6151b64b8d2c711957be2a4241f72ba5c038509fe2397616ac5bce75671f3fdc0be7a2cc0e1eb92694db1b6d55040c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c20ae3b2520e93ab47f79cde41b1d238

SHA1
17893a3a967946abc010e1c2a47b62578dbb90b1

SHA256
de621f1e47729247856bce18d38f04695f9754cf8f5818b810616eb31812975c

SHA512
b291e39d557ce1ceefa45c8bcafc798183a5a28b519ac55e6e529905096c6677ddee40f1f05ab9b6a839ab4251009bb8fe182d8465c32e15fd01e233eb0ba187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dedb615c14d371243a6eeb2d1425206

SHA1
3e1f2739318c7a3f4b74442a36761d71af937a32

SHA256
39d68d472f137a27e896625068505342c47c72bdefc8b9d788f120faf83ce4d0

SHA512
a800470f6515f4b457efa49d4be14815483ddbe21dc1a42534b6bd6b575da28cbf9b33fdd8c421e142220dc246c40fcd43e303a45800c6273029c0cdcf94ac7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
df497bd8080943d26ffbbecbfaedcd61

SHA1
db463bf924b5a1f859b7a09851b11ae25c830517

SHA256
84a9f49d1a5897a3020031db3a162bf8133248131f1a09ccc216a76e617ff306

SHA512
be372825524b31c434cedc3131a1b6d1b0992b77eea1110bf26b001912a14e7aac101c1bd0f58d5d475a564bce323829b44a611dd2847372603eb6801666dd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
c1aa80526a0a10875a91a3910c3e4260

SHA1
063b9a23785f7ad928e305a9246fd4b1f7a77c82

SHA256
ed3f5fce9ec5be60ef21b4e1a5cc0a41d38a5d66bad547d245994091e99e7768

SHA512
206bcc8f9023559edea457707aba5ee4fb9d9aacc759945537e043d93fe34396e82f6141c27523bf8035aaf33bb3f568d1646118937ed9609fca999913313137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582546.TMP

Filesize
203B

MD5
af4f273957772da26de3cc0fb33472d2

SHA1
156b70040c63e291528b79b427660d4b4b92dcda

SHA256
9944416dea10cb9d9446541c672ff02b338e55579b2000eeed081050e2b30d3f

SHA512
e2adef50747d431ff45728419254fda27f5409ad9ac6687e3cf3bf263aa05dc1e19638a28daf4eaa89251680c412d25e1965c8380a7f564f8a61ea58b5d98027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc74d21c1f9b43d573ff133f9ee43a40

SHA1
a97fc021ff27442269674854ad019cae533f5608

SHA256
b1a98fbe87c51fe6228d13398b1cdb913e7aa2f96fd758e23b00a497dd64fdd0

SHA512
3cd5637905b9bb80ea1463ef4f88996fb43e9436e2dfd5c2bed01f14feb21c321231319cf1dd0ade2b090fe5718c80a596e4396a273c3bd6e692be4e44d3e6d1

Download Submit