5fb88f4dbb45368e0040a0ff551e8b779b7c04f859115685cbd3cef661207d2e

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c0f2bf7ce28b051a9ae26a614b25be46_JaffaCakes118.html
Size

234KB
MD5

c0f2bf7ce28b051a9ae26a614b25be46
SHA1

2dbf79a80c4da79d67113664641f9842ae627dac
SHA256

5fb88f4dbb45368e0040a0ff551e8b779b7c04f859115685cbd3cef661207d2e
SHA512

ffecba7f3860dc1fae61bd052d05f0f584cd59eec554d18c0af1a998ae69124f273bb0909b0f71cad682af0281e93a75ff0312508111bec499b080814d05316a
SSDEEP

1536:uHX6Lulh283XgK0X/p3p+TvYlO7v5QWpwKnoJ+zHY0zm+WLl+pg3lT56uDF6o+3x:uHX6LYSO29J+LPQcpg3ltBF6o+3ko

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
4996	msedge.exe
4996	msedge.exe
1112	identity_helper.exe
1112	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1116	4996	msedge.exe	84
PID 4996 wrote to memory of 1116	4996	msedge.exe	84
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 1640	4996	msedge.exe	85
PID 4996 wrote to memory of 2188	4996	msedge.exe	86
PID 4996 wrote to memory of 2188	4996	msedge.exe	86
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87
PID 4996 wrote to memory of 3836	4996	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0f2bf7ce28b051a9ae26a614b25be46_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd42d46f8,0x7ffbd42d4708,0x7ffbd42d4718
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,3977008076126982145,14275286571778641162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5117fc67fb41e0979949d7495109c204

SHA1
807bd390d96e63f3a289fca0c4dddf009be3beac

SHA256
ce6ae507c1f5e6406e40e37a7460d91fd690a4bbf151f85ba80374634787e89f

SHA512
020c4ad14c133d34cb39d335023027c7c7f08e214635c187896e51ef9e5dab29494deedab4b25017b4b127d6c9dc062bd299210111e597e687845eea3a7c5654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
24758403b6b407eb5a313d999261392a

SHA1
796ef50f4e54e867ac26f2941a693814d0584a82

SHA256
e962292794fcbbabe38a070280bc4497bd2246ea29d6a133b87ce53b6a0c84ca

SHA512
ca55af2961ae8ee7c4e20c20ac7ddcdaf4c2d4d79c9185cb7e8597f259e5c0ffd14ddd2c20a303758bd6fc2ef7650e8c32f000800785761836f251d56767c211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
532b577caf0cfeec41585e50e9e96afb

SHA1
b61229df3500d1b482794ec47e727dc297b44600

SHA256
8ce8444e5994deeb8217281091e9a92fb07b24dcdb6d0b3cad1ec30ae0a39469

SHA512
681fadfa011706107b9445817acdb365fb8e1fc24a56847e17fdb69775de14fed948883d3fc61d65014f839687f79fc539958b7ab383ab6a7bc97a56dd5c7475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ba3ccfdcf530a3285d5b013d7ebef79a

SHA1
e497dcf1fb935cdb570e016b829b6a349bd5be23

SHA256
66ee7c67cf19183779e177001292fb5908646db29aa69bef876a26039171eccb

SHA512
0744447eabd7a80c835b03f1e669e6ea0dc20488c78b287e8dfac2eaaeaf5e753798a320153547a27ed7da9d847c7bc9ef5b46f72628ec2e4cb16eb7a06e2003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9138ca89addeee06daebbdba72bb79e

SHA1
9f58847f53fc57454ec7b20f0df3284d33667f82

SHA256
eec5744faa7526b8cfdb65738381e388fcd039d8548822939654197b91edf561

SHA512
984c5d509ad74f4ede15d6a502052302b831645aa75efa88f237d13d66a1a2f806c11983abd99da2d5b7a8ceb222da9fdf3cbd5ee373761d0072e3ec67c103b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d7a0fffdcc1a25899326ad6b551c60a

SHA1
6c9b47a7e81de686a5a0cf1092dd14ef64c9f91b

SHA256
3fa6e05add336a7cb81175d63ba9a20fefb1be94181600b0b9e22ec0b4675f72

SHA512
a9feccde260d81043cd29af9e09f43e48c276ab6edf50224e8020c7158dd81511e2f476f1587015ddade2da20abfefdc91bd7725a0876f02818f5a619849c580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3350856b78e550f0acfa36b5de037171

SHA1
0b0eccbc3958bc6912bc9953e6fe69b4e5ce9ffc

SHA256
3fe3d890779c9ec65db33972460d358bc948bfe687bdbb75d8d1a5b23fb7052f

SHA512
d5e4a106c2ceeefacdc5591665ffdef4838ee10a2739cc9d2ed37ecc6d3fb8eba0566b79bf38ef72dcdddcac14649f9e6758056ad819359443839d3485fe11e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03a55b8378dc8856b8c2d5e1dc828efb

SHA1
6fd87e64eb051d26b9bd36a0d19b43dab5794f32

SHA256
6f52d8d022fae319c1f4cc61ecead71f0294d09d579cb1e9105cfb2149d297c0

SHA512
ad30d3c16a336d8e296606671358204e9a44b42c5ef70ad51be545786f1cf9a6f25b679cbb8a131c4c61acc8efeee1a3894d3d8db1f28f3066a7d9562e3ff691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
57b9ed8a0b55212613417f5060b6546e

SHA1
82f968039c4708ca2be3f988ee84d75b6db96029

SHA256
5cae8eb45f0dfe6f654433e0a55ecec365b56f4c3af1a8514e8eb3fcb3f1cd3d

SHA512
7f8a52fcdb782a0847f64b7d50c49d22b4d8745ac65f83dffd0da7235390af2ef792d60fa1dba211ba51b3d355695b5361c958cc0fc2303e0b5728f82e98d6c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58412b.TMP

Filesize
204B

MD5
aa5f5752c6d39af7dd1830c360061a4a

SHA1
36f73c4c72090e0559aad75f7ff067bc449728a9

SHA256
9e38a59d4c6020d58eefc4ee6a6b0049153504e1840546c341880a543f812938

SHA512
5a5d716f625cfe07c4ff89defaecef0e1732cc398cafe18604b0026bc25ba1c1ebd08b25dfbfa7cbfdcacc1acd955846df61fdbe2e8edabfb04b1106565c8605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dccd6eed24a68e7284c6ddc2e1871e74

SHA1
ea3bf35b8ae16e05cbe0073e96e33956ff30f809

SHA256
53c51872adc6ff7824bb29a71fa394c2076a075f8e2d53c6eae9ce00a36ce443

SHA512
765eaa3ffca49054c6529a7e07ebecd7c466bde8d12df6924c897b6fa0953f056a33626d182729b374e0d85143cd143654cbfd6df56451a1a268946554833a78

Download Submit