082e2b2c3894ceeb6577351bcb2d9488d5e1b8ff7aee0f70b938cd1982b0308d

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf6e2eba7c296cc243bd903015136daa_JaffaCakes118.html
Size

107KB
MD5

bf6e2eba7c296cc243bd903015136daa
SHA1

a7d2e190c7618ab6acebd486c663bef986e9c768
SHA256

082e2b2c3894ceeb6577351bcb2d9488d5e1b8ff7aee0f70b938cd1982b0308d
SHA512

a905b806f394f05764e9b60a04517d0991f5685680f0404c302fe31811dcfb0e964e8a5a8b4e661525c38df3acafd2ccf6a6154adddbb5a580042f61e8706396
SSDEEP

3072:HnLFLbnckaYJN3McZf+f9Zqn03+JKRvcjlGz06Nd:rFjsR

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	sites.google.com
14	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
1248	msedge.exe
1248	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4360	1248	msedge.exe	84
PID 1248 wrote to memory of 4360	1248	msedge.exe	84
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 1088	1248	msedge.exe	85
PID 1248 wrote to memory of 4524	1248	msedge.exe	86
PID 1248 wrote to memory of 4524	1248	msedge.exe	86
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87
PID 1248 wrote to memory of 892	1248	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf6e2eba7c296cc243bd903015136daa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90a0446f8,0x7ff90a044708,0x7ff90a044718
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1384 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4171615773614962943,900230121356595042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d854bbfe01d6e508096862b844e05996

SHA1
1fd36d724a679124c3b6b86bdbc839e34e32c847

SHA256
c55da1bf9fb5b239d7282e58aa817bf3010f6b73862b144b44e218b5264a0dde

SHA512
55e15f2f46a2ca0a586781811ace493c1b93978332492210df73637b49e60831e8910852615a19fa75ad1786ab4cad722fc655790d9fcbff8bff2c4c443ef830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
d2b52745f5ba4c095e2f492846c42fd0

SHA1
20fb7e61298f654aec2ebf1b032e46db51d6e2ba

SHA256
be3aa197af104a374f689cdc86487f0b5cbb5751a8e646006a43de6f92f76421

SHA512
488f0073c9717283c018139720c8b27d3bb18cf6bd641d972c2a22e0e99ae2e0d5363d2f18dee50715aad20bb162bf04cf2449912e0f06c4291e8fb3a4072fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
70d741011add331708a94f7b541b3d9e

SHA1
8c3a583a263167bbfb4c11f6c782e9c4da41ec0d

SHA256
100a3d3c19739ae373fc7124934f0957acd8352625ba2654ad1d7b2f2a3ec3a0

SHA512
d13233e3d7d561d3a8d174f560a26becb64dc22b5ab7ca0009a4daf2262cff1bedbfd1d1de6c85a51b7ec1028263c8e78fd988b0652c5e00749e3d590fd90cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ae7c486fdf11b2b969e8de61c61619a0

SHA1
321c5f8519c891b8d3e56ca33aa798f3ec3343a9

SHA256
4e0f24318bc8a35ace605bb86927052758785da8ff38b9986a44970cf968b0b6

SHA512
45b3fdf16782d7c913c9e4bfa22aaba944f4801e2c379af7c0a549b282f4bc6de865452ea0be695ec41d0b263cfc8e695c870be232746109d68c439df8a0f0a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39f54ee7c63f32d07b0a055e58e57587

SHA1
0d07db6c3c88bf8dbe728f4cdfdacbdc1b80f6c9

SHA256
3a37fcdfdcc961969ac3886093eb2938e30fe7629049b054719c3ea73add1380

SHA512
97ef091785eeb091a10c2addd58e479b1c2ed217f1920c16c888612b164a11d18b9b7e5ae65d6b6c338ebd9bc382251d6ee9553fa06823d529838063a3b50e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5c306cfa2bdc83507cb6c31a585e9da

SHA1
ccae56148f6a28c136cbf07da1d24459a26ec6be

SHA256
4e3ddde48fac626f7286b27806d29ffa1b71d81105f9c7436387184e9137df37

SHA512
05042a19158914f1916e369eaf67fde4032dd933546b0f4a813ad8705394591e9e37b016bc9dae950e4222a698591ae14119ce6884f7616c5a2e2dc12d075733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f392476b99e28a8748f43b2a26515166

SHA1
8415e35f25cef439bf423ace5e6a7fae5eadb841

SHA256
84d9330dee1b10f9ea3fbbf7c1522c5a12d9f915bcc70c99188d7c581c4733ed

SHA512
ac6b4b9b9d0389c915c3d5d1a86a36e9d465f6fc411b5eac2d4d4333b15f3cd35ef5680436fb8d0a9219abfea65476aeb32ea1b577baf18bf0bde7a03f30f4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c802ab5b6b81e28e4a3ab42a6e1c0578

SHA1
52e268ee5cbaa9790f5fa7360b30dc15b7995f24

SHA256
8930dcbc235b8e379e5188c7665c983177c17dbb5cc99ff8ee10988f6fe38c11

SHA512
4c06ede5f18beeeae1cd66327c3c714e251e9969f1c1566b12232a19581c66754b18637d2558af21c93e87b2de6eb50915e695a90e368dd3d35c8298112203b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
0d36b72307805d431d231faca448d63e

SHA1
ae238dfb11f302557f9657d6851b4d9559bd2deb

SHA256
b5d227953ad8c99363dd742fa89b5334eb8cd553850e68cb3e9e3f41426370cf

SHA512
0a9ace2b57a8c58f7bfb7ac27905c743ecc2abb9e3e6a0193cc77e9b220c3a841f48042479ae04d21decbe453174e8cb630b5650ab83eb37e8463a41424f7079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a42a.TMP

Filesize
371B

MD5
88b6f44b8bda513def9c50f181b0c096

SHA1
0d1c9c8a5a9a7498d8ab328fdf00cff486b7516e

SHA256
83101d13d14ad3af0f9719e824810d32bcc00fa0758ba479439cc45a9f75456b

SHA512
eb255a23b7000fc9edc3fee9ae918902cc19291c316749724b5b1dccb379a55d34c2d41c4fea76f8369a579f09f6f36291246986eb0988b918d7a4949fd0ab71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e765abdd1da83f36fb7bc759786ebd2c

SHA1
734813f9c22d5ca4af45713c75610a0cf3762b2e

SHA256
e0e8031f498968b196eec31c503479b72f2d8f7c141561437c5666fcec5c0c51

SHA512
a01733c95d94132ac17e8fd8c26590c1cc056d8adaa5e0e55349f19984d468ad1aabfeea0ea2f427688a32ef6662ed993c0af41f7b023539bcd9384225c064a9

Download Submit