c73af4d22b08d90a0de4ef580a0dd2ec57981a152d69da92d8f0b4b4883851ba

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d0457e2bb46c15863bdc6b003cd51ff9_JaffaCakes118.html
Size

226KB
MD5

d0457e2bb46c15863bdc6b003cd51ff9
SHA1

31c0bae66065ec4b46e2498a93026ce702a280a8
SHA256

c73af4d22b08d90a0de4ef580a0dd2ec57981a152d69da92d8f0b4b4883851ba
SHA512

fbab379c9fab97fa0ec26ed5db700b3e0e882652cf7af539b9070b44060d76039d97a8338b5869c9d71bc5ef9cbf56d34520f6e6876e033d1cf97298cbba3916
SSDEEP

3072:4sfNOkCRMmTo9eGY4Lzfjfxf1l4yY4vozlAuo5LP3kSUR3sa7r/fQQe/pI4Wd9mw:4RPTo9eCPr+Seu6LBiY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
4928	msedge.exe
4928	msedge.exe
2196	identity_helper.exe
2196	identity_helper.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1232	4928	msedge.exe	83
PID 4928 wrote to memory of 1232	4928	msedge.exe	83
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 3044	4928	msedge.exe	84
PID 4928 wrote to memory of 1968	4928	msedge.exe	85
PID 4928 wrote to memory of 1968	4928	msedge.exe	85
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86
PID 4928 wrote to memory of 3024	4928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0457e2bb46c15863bdc6b003cd51ff9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8ae46f8,0x7ffbf8ae4708,0x7ffbf8ae4718
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5285641063898606350,3896676472123486204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
302150d390fabae6dd31b58de2ac2cec

SHA1
9b6370a283f5f76efc2376e73682e90d7eff1f51

SHA256
6adccb63e0edadbb568b66fada753f8cd0aac57a19ab65dea3c3af3133068f14

SHA512
e3dc2a92452f98f6c3804c019102f377fd1c3fea356fa75c7f294852833ba10bdfb7bcf675e13236c7e1c40b399f365cfe4a866fc191d2411dd2fc43f76e7053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0d2522f3ded02d6c68e0cd84df7c0225

SHA1
2428f1b140adcd9b297050738f47bf368cbd43ff

SHA256
3bdee6e180c4cd91b00b3b7e9564176253b789a079f99bff287fa214955f38b3

SHA512
bd79cce4065ebdd40b3809d5e215b784734ef0cd9c782809cba878b044b451e01f79000e75a8f343c1a60e6f659eae597ab13817ff77d9b655af5db96a224604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ca3e7a6d2b297b0cf9f547cc509f20d4

SHA1
339121b7e54e4525a38d8c1336a425d0c765fa7b

SHA256
e40808d2eacb914d059deb76fa6ada9ee15f08fc3cdb1fae0949022eb73f15c0

SHA512
422ab67697d4c488b6b2b581be852e8debab442d64bf7c6fbd8c8ae9e9e51b4d279c3e32105e6014ec53a7ace3d763776767044d083ecee0a2224d69bc99f7ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
74c85f726deb73933736dabcdef1ccd4

SHA1
040fedac55801c923a535cdb00e0a6f46934ae88

SHA256
6b7415782de3aaa4918c84eef081f930e74e844db6778171fc25b5a4fb89477f

SHA512
d2cb45df53e9727638ecb003494000275c28185ecc01f0db8efc79734f90c702918ee20fedee6e5731a9e7b823825334ed25f35654f81cd4500241c223830e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b964c30bb18ee026ed33ea5c5178fa62

SHA1
86fb8ed4326ef2a2143f90161266dc15aec26bdc

SHA256
a4b83adc6564e2fbeb355a975529b28aa9b7a15c78584eded23b4daf7643af74

SHA512
cb9d26a65e2c3646d12f987f2a058f79e81b146bdb2ea1ca5f56e5a02c604c4c493ca9ef71a150855e8b2be90eadb8d547f9bfb8f70e2cf5719dab4f78d9a14d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1dbe90d305f749b20c3cd1e5f0b6ec9e

SHA1
a156fa40e207ef80f4e52813824676df57bd8651

SHA256
0469aaf3886cb59886f32d6230b3da63dee9d9df937aa615d8f74c27f35bbd23

SHA512
c4088329c5acbf0c55478f8d0b501f150d0d333d71f3a5d944b2f7d250d74285bf862a65c9c9b3f6e1badd4bd8224cbb1b878df702521180fbd1b5539d03e943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b75002f2ea4cf3be7b6166b31b98823d

SHA1
4f474e6f12a3c0663096947a6f83417f82341b6f

SHA256
e8a3a8eb6cc3471f7651db0532d64d03ac8e27cc9e7cc7da0593090349013e87

SHA512
c34dd6c520b91a565c690068b2d2ccf0352ff0166d6be230a2156051d1ae9a180e31e880df1f46a37301235d4449454d7aa26f42484cf496acb6a2c0900a02e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
accb317a4444a2e67b2d84a65fe1a660

SHA1
e7d36e848421e90b02e4617911e787b75ff90072

SHA256
b6f3d185cee156a0b9824e687941c19d2e5b7940ba3f764e4166ba09db48cd06

SHA512
519010fdbf7a558a37af8f4d29d79f0d495d452532749efd15ce4307238034d288b250222a3f6d0244ce78bda614cedd75f5d83e9ada209ae8edc6e7afe7d3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
34cf7abed9d809b1c4e21522332a7e20

SHA1
ef472fe245523e3a8582b4a35b2c47e9b96963d8

SHA256
c35b8a4aaa40518ffb2bfaa062a133f8481a3177dd0fc760f7865cece079efd7

SHA512
d2001115e14167755c1cf4d89fcd2251b76b8df772cd26b346beb667ee2a677568bae83e4805a3b0bb28648d636a27a8a8e5acbedf7adc662e28de8c4636ff82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589e00.TMP

Filesize
371B

MD5
6850f45ec8d02aa46400559000d265ea

SHA1
ce8e6192185af204815cad7c8f9dcb4180588499

SHA256
d85eed0e87e7be0fc20d4e7f775d77996c2bab2dbe2d4e301fc3232b3a3d7621

SHA512
4c85fa0b958f6553465274d1e47cb1c5bf6f9ec94418c88a5166bcb65d4ed9baa9cbb8c8e6b72e6454ee2064282b6842882ff3fa701d10c9ecfb1f0e496240a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5325eca53c24fd8a600b6720d7510646

SHA1
a98bd8d415a495ecd81deb135bccfab2566c294b

SHA256
2e50cf1c5d42331024dc1e4cfe40203a1b092fee43b783cff17fa18e92e7d7f0

SHA512
2c89361a6df8e04d7cf9200cfa5cbfbfa78f95aec8e02349cc8b1f5809e5e2766a1dd20354437abf73145a87c4e8cc52294bacc7bbff008f158a807f66bffb92

Download Submit