624309ddc3d85dd92a516c1e411e13ffdb4d0889ddc45691ead177791c429062

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f4785a43d7f827407a23dff5735b6a_JaffaCakes118.html
Size

98KB
MD5

c7f4785a43d7f827407a23dff5735b6a
SHA1

c3945191ddfb4e3400cb9e51059c7d8f967a91d9
SHA256

624309ddc3d85dd92a516c1e411e13ffdb4d0889ddc45691ead177791c429062
SHA512

e3bf54d5413a41511814e6aad14d1650d9c6fc4ef65df019bf5135e7ba15cf8db1d67e1dbdfb207bb2a937c095f566cd4e2dc99e121558055aeffff25747eb44
SSDEEP

3072:QnZj518vxSwOA4WQI4HVTqBEMpo+DYGSJ:QnZUg4QI4HV+G6gGSJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4528	msedge.exe
4528	msedge.exe
4140	identity_helper.exe
4140	identity_helper.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2428	4528	msedge.exe	84
PID 4528 wrote to memory of 2428	4528	msedge.exe	84
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4328	4528	msedge.exe	87
PID 4528 wrote to memory of 4872	4528	msedge.exe	88
PID 4528 wrote to memory of 4872	4528	msedge.exe	88
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89
PID 4528 wrote to memory of 4684	4528	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c7f4785a43d7f827407a23dff5735b6a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0xe4,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11550811845099571990,695635249087763809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
bdd8c0d192db1f77ede4c1fb2073d12f

SHA1
22ccaddddbdf8c74d1e8c4a2226237f3a7b2e434

SHA256
41a5594f88240f3ef49bf68c1504675d7cdc04877016aef3c5ae1cd82c421534

SHA512
065de85ceac84176376b1359393a9b64c998279fda318eaafa4ac0a749124894976af95acdc3e426d5d18fb588154ff200d5592154b5ac99b00f49caf647d0e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
771097f9c41623b6a3d76e7a7e32ee28

SHA1
f7645a4b219090f339b63f1e23df867ace31907c

SHA256
52b4d266acc09fd9bf22528e26577a30e808be49a1aaf0518f8dd6dd4225fa27

SHA512
dc0d3fc1f43432eaf8295a84aea8e918ebb0ab1e0ca4f171c4a12c769277fe8a0732b658860b64f7386fd2c774552d489e1c6a0d109930b9a32550091e148aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d7ad5fdcaad09e6110a721a12b9c78f9

SHA1
cde501bc788c94d0eb05eab902f05333b43fbe95

SHA256
91761b7a8efa510959228b7a02daff98e090a7a52303ce39c9d519fa031d42d7

SHA512
32763b78a2a2caf7e9b1e13189c91e767bae9cbc33315f93f3b92f4d07f3a8a22367ea57276497c157f9657b26369eed40c233581581ca23a323da69f00ff514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a09da95498126f5b43ce3043850846d2

SHA1
80a92ec655283703272ea862d9b33fbd336dca68

SHA256
e1305ba8200c08b86ec29df975cf5b3ccdf7fec795e9508bc2c121936adf9864

SHA512
5ac4dc3b41540f2b913ac4a825ce0fea2331f71b1da155a51c59c8553b8776a9225fb939777748ddb10511eb7ba2320a6b650918925a5fd532e6b0cc330d0882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40345c0e3fbe0ab05624c6edaed7eaf5

SHA1
5c786cb4841cb90807b1aac53a91e18be9707b99

SHA256
a066778e08a4095519fd61108d5f25429ea7a2b1b757bb22f3d021cb9b8ae3d1

SHA512
f7efdf5c0877c89171266257b865a9a198c61c6760fd64e90a58b9466a886d87f33db02b14153375fbb74ec801c82c0fb97dede24b65f2bba8b64568f87c77d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
375bc740ac7e543038553f8987341ae3

SHA1
6daf9238b91edd7654256f949a1338f040917977

SHA256
6611aa97aa57ea37e4ff2884005a172e73256999a67335f596e518c078327967

SHA512
2b50a3df3a4732a13d2e14e9c10824d07a6fc871e49003025b57ded0471087ea96c98c4d73d82222654a77cced133bb33c9f3cb898efe9d8263a82f996139200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d123a54bf29e2e6ca3e3d7a895138f82

SHA1
800c4abefa80d8c759e04d27701cb653b86e93d4

SHA256
80a63345a0d1f84de6f821300b2ecde2edba47924fae37ddcce9d471f8d38b85

SHA512
72a3ce055bebff979673789963600fd12998fb96aaa14b31a2d26a76f62ef5e5734ee2590416480bc94f6db5d4ce82db631cf33ff1b60eaa78418f1cb84b87b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58313c.TMP

Filesize
203B

MD5
8414c8dd4f8ddd818254dfb1bba6944e

SHA1
ed6caf2bc56207d78de1234b50d2d6d54dd6db7a

SHA256
dc807564bb448f5f9b9854c6e6b9d6a6116cae7ea095106d4c252d61b5c2986b

SHA512
bf0c6af90239ea1562bc431633a3fac85da3a01dc655feef8b91e2bcd2e1099a53e6bbadc44d6cd796b7041e136d712a20b98ce1aee86ee1fce693c1f7978783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8aca446f3f201a1bfc500135a3d08b4b

SHA1
279b4602d2ce882785dac3a40bc1b0a43d4011fa

SHA256
5f1454968433bb50481dd0476cb273b6c7e3eb3422517f87a8d64eaa0afa4b8c

SHA512
e0a1ba60f0c71c41fcedacb822fe632f2174c00f386c0b9907fbaa5c70af42767deff251881e4ad9265064381abcd8faf79dcb4e3d2f666877e9caa8f4bdf120

Download Submit