c064f64423e1bd51b0ccedf3f440d2eb5e00cc7129a7cecc157e01b6b725731d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d3451e4638ec0492a78fc8e443dbee03_JaffaCakes118.html
Size

57KB
MD5

d3451e4638ec0492a78fc8e443dbee03
SHA1

f464dcfe2db9ff428e648cd61d637bbf7e497fee
SHA256

c064f64423e1bd51b0ccedf3f440d2eb5e00cc7129a7cecc157e01b6b725731d
SHA512

d2d1b8bf1567bd58c865bfce10490682f0a523ada5de98320c7a4f635bfd3d26e0b47ac9be6f6b9900f975f2191641b2aef98dd3b9e522bc90e03b11eaf418b2
SSDEEP

1536:ijEQvK8OPHdFA/o2vgyHJv0owbd6zKD6CDK2RVroHEwpDK2RVy:ijnOPHdFL2vgyHJutDK2RVroHEwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
1044	msedge.exe
1044	msedge.exe
4316	identity_helper.exe
4316	identity_helper.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2204	1044	msedge.exe	83
PID 1044 wrote to memory of 2204	1044	msedge.exe	83
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 3792	1044	msedge.exe	84
PID 1044 wrote to memory of 2976	1044	msedge.exe	85
PID 1044 wrote to memory of 2976	1044	msedge.exe	85
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86
PID 1044 wrote to memory of 4952	1044	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d3451e4638ec0492a78fc8e443dbee03_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff636c46f8,0x7fff636c4708,0x7fff636c4718
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8636179815154785352,11236243374913720138,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
a7f35312a4b09f7bb6efe181785d4451

SHA1
f429e3e8120d6abe27b86cb59c69b99755b8a338

SHA256
c45828898e60522dec15f64590138cb6348aa6e0d27ea29cdea065de29d1695a

SHA512
a5e8a5d9c094cfa9064b09b667b56020421998f496d0ad6de00dfb847507467265d64203de1b56e1784a0f687d6efbb26fd9d618bbbc2f939cc11cb72e586053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2037693e5e07a9c401bfeaec240120ad

SHA1
b2025f5d999832f0a5105e0334a9a26b67fc4969

SHA256
848997ca113066d5a77109f386335263534a20c66bba2a9b95573a7ada60fcdb

SHA512
6a6b49469682ff6549f2db822883409c0fd9b837214764cf06b91c1657ae8e243cce0876871a9538a2dbebea8d72a4fc9debf86f47dbeaf2f12aa8ea6538e171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0eb10b070663000fe8a3a30c1b1b3020

SHA1
c937d7384b0e961eba8a37a6ef56fd2171476000

SHA256
6f8e6c4dc01bf830a253abea2f829011a11ec75593336af5f55129589313ae12

SHA512
609f6b3b01ec683e04ce2185f9af36bd0dbc0bccd13aeb4612ade5a71298cd7c14899661074a6c065987e007d3faf073b223426abef8798b52c2133ef49da273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6224a678f7b33b468aff9d413e561e65

SHA1
20a5d774d775891d6124997da13526da2c402fa5

SHA256
3e817eb03b29051b9d6d6e71abe157750c905cd7423895c07a90e08d28a715a9

SHA512
b00ab74452b65aae41f2f0cd7751f551ab7915dd93cd3c59e503cf2ec79fec7195161998ebd1b13fb3b7f7f9f42bbccb33aa982e49a64f39ced4d6145562b890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5bf3decb4c6a98ca341dc1ce773994bb

SHA1
b5ef90efef7cadacc1e912610b50a2277fe48d52

SHA256
a56e581b852047c0a92212fe66e7cae4be19b690db2cee8f90854d19e272503c

SHA512
e989e2253f6701ae78807aaca595cc1ca28f2922b7fad26c545214791f1d9cbe798da79848321a0877efae23f6bbe6d0ed3ed83c82e85a8585a8a1b4e4764b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
998646aa3576f190050b73cbdebff93f

SHA1
bd444b9d767e837f876d947924c411aa9304c9b8

SHA256
f98cf7f41c8d54e86b541ec5e043d16975cb952f1055490fd05d2cf4a18a11b7

SHA512
6c51f62c485401ee0b42e11ececf5439f6eae9a5b5748d94a3c476158b095b4073838206e5b2409439da2dca51caeff37af1d7d72dac1775f1638881ee51b941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
105e39b2b9b6cc1b341b40396b8054c2

SHA1
222f7529bfc812f944e5ef6f2056cf72b5927aad

SHA256
ea271050eb89a80e10318080c5b78e0b5fe91e713f25a7344d59861e2bdf6dab

SHA512
51b8c27b4d17bbff1d4601cfcb09ca5057f5cc011a36532170da35f25c37b45751177ebba836c06f4f979897402f2e5704429f74dd18a417fb4b643aead27d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58216e.TMP

Filesize
704B

MD5
e5d0480034038a2fe8aaff857e78b997

SHA1
9f10425a080dd2e0fdbf49945cdebe1a2b5def5d

SHA256
b99364a4aae305f6281aae687014d01f7a30d3ec6e884538a15af302cbe841c0

SHA512
5f3a09ede13826084b6fe5d141d129883d0fc9cb5d58d7c7d8d34fbc61075be7b3871b8bea2cd1e66b0148a203b7cfa53d63b6b955521fafea52cf3d7bf4142c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5abce7f1b8d6a0d14ab4453d9160f4ca

SHA1
7cd1bb673f76115ef9db862928c31cd4653136a5

SHA256
58a020ef41d24ebafc7508ed68e0e09d19391ecb0d73e7b69de66398a2d23b35

SHA512
126fd89a79f555ec3fe434036eded8bf4e00128741bf348ec4faa59d5593c13c8183bc3e9c8f424e9a224d530ae1890a5ffc65b827ae5df0cd456c855abc985f

Download Submit