12009b9c5bd9082d418d9a2c9783f7b585f5f8b188b8e7a531908eced4737cb6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4a287c550fcc04caeab68adc60e254e_JaffaCakes118.html
Size

311KB
MD5

d4a287c550fcc04caeab68adc60e254e
SHA1

b4ed839bfe483b99871241ebda17544d00ba0e99
SHA256

12009b9c5bd9082d418d9a2c9783f7b585f5f8b188b8e7a531908eced4737cb6
SHA512

d2869fa5ebd0999ac25212b4f35e386c316838d53202bd9450a05e4ac56ee1c2e8e5df6e322678f2e3a5792d613c9b502941f4c0b52c30ed7aaaac7874d59ed4
SSDEEP

1536:Xn+SbTTF9SjTeINkltM/jVII3IbIre0WXnAmB6o0TFJLnv5xBhyx53p9dE61QHHF:3+SbTTFrIItCVI20cSQTiTC7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
3032	msedge.exe
3032	msedge.exe
3336	identity_helper.exe
3336	identity_helper.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2296	3032	msedge.exe	84
PID 3032 wrote to memory of 2296	3032	msedge.exe	84
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 2676	3032	msedge.exe	85
PID 3032 wrote to memory of 4988	3032	msedge.exe	86
PID 3032 wrote to memory of 4988	3032	msedge.exe	86
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87
PID 3032 wrote to memory of 2416	3032	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d4a287c550fcc04caeab68adc60e254e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff3b146f8,0x7ffff3b14708,0x7ffff3b14718
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,3445713282580550439,17222395906374057537,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
219007f230e0e70233148aaad56d4c14

SHA1
b6bfb25bf510e3306bf97857588addb49f6c5a1e

SHA256
9bade8917f5d756e8dfb929651a014215ec797c7728dfb42978f763dbac3f915

SHA512
d16b6113d255e55a4d6799bebe32c443359b66022f2a501725cfb736acd2cba0a7446bb1d1edd3a1723c559f9ca79c6619198bc62b293c27420807100880b61c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2c9f2cc4946ccc923ca3f45892b3cc01

SHA1
6622af7351d3d9023ea924492b99a10f21f28bde

SHA256
687a999cb78c14360604a079560df215ab2ed99bfdcfe5897b0f4f56548e61bf

SHA512
e3ffd38c594d431cd592dceee1f264a04ffcfd1c66eddb8018afa28f69038a141c8ceadcd61aec6abfe89f98a0ca6fec1cd0e0488d730a0be16ca043fc1631af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8b28ec1c4b7ac2e6da120639ed5d1a93

SHA1
ba87818f180986b9998474903abe23aacbeea245

SHA256
d50eeaf96625264a6d410aa9f70dc066af2df364a3123d6f66026b1152341075

SHA512
4511c29ca437dc8bfafdafce9d26adf2d089e05ace11d77202efd2018afff5324592f4b2b2ab4bc52c9582b0b484082fcd13bf6d62d1908b687d2e4647db3a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38ebc80242ba82b6c664d4b951a7179a

SHA1
1ecd110d65a9b2f9d1cfc80f3890a1fa6a908ec7

SHA256
51e195ceb63905b753cd033d241e017aa404efb9a2ba040e0ec643fe23b77aeb

SHA512
8344a9f113048d8d6a278c0d16346531eb3610dc095cdb2375dee39145e5b07a8d4d245735732e8b8953904946d839faed18cd2f43a15efb9c7934f3d53b4a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa218b938f39b41486af01428d1be432

SHA1
ae4b1d6e3be5cc4fe68648a9e7951eb085da6018

SHA256
de61bacd6aea4e0c7a3adf971f1154fb06582cb44d49022b51f290ad320a96a4

SHA512
68a64282736dd5da16761bc50b9e2b2ecd1e138f7779ea3ff0d09339eb6d11a2b58a8246cb4753ca75598b15d0f857525c6f3213272e092ed1103d462ae9b950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afd7b7166a7bdcbdc61928f8972f45bc

SHA1
a6d780a7f03465895211712c8b4a6e4ed6eefec6

SHA256
e1c274b89f18c8f6a1b250973815e5b496cd07bed536e9a105e249c5126d4d8e

SHA512
91b7ad6c381f062b1f033068ed0bae37de2791e0a21660eed4c252c396e403619f45732e15c64fc0a51f54ae43b6ba257c7ec7d9e28464db76e8f4a141163032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fccc54bfefc508a7b488b74bea0282d9

SHA1
5deac4efdec6fd2141bfd340536cd29f6a893015

SHA256
b741c65773655ae42e12a11ac71b6ebab3fd847790a35995f2ac3469c35de22a

SHA512
d07b0920a547e69c556a9fadb9361a2a9463c4ac75d105b0d12b234c9e9ab4bc7a0184b1bcf8b1ae9c5e70e5b5e02bd107d6014ac9a594a928d76053808b9318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
12a2886208e48d28cc49fadb9630eea9

SHA1
ffcdc8bd50218c531a45e764253f853bbfc71a05

SHA256
aa2dd5c697943d34254fdf0a730affd1b46f38f5ea897cc7e863329b66eeb131

SHA512
15fdac2d0ca3cd5c47ad16e6bbf4e19a526a98ecdd212880ec2866758314f98d42b1aae00f24b32f392122cd664926f7aa7bf1bc24421af003835a50d6e8c7f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809bf.TMP

Filesize
203B

MD5
d9e8841281e6f48a02e1d5fa1aa8ca12

SHA1
84434c87b5735b65beeed678ed381097e164a057

SHA256
3e2abc4a1418a6ecc60888bfea54272ff814b77de8c727d6040214f3ec5fff69

SHA512
eec785cc3372d87a29e86866eb6e2cee77b22addae9854d00060a4664ed03b4c167c1326bd21798ed3669aa43a11d461214d2365eac358388918ae928de026dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4477d08bd148b6d7310be22651ba7aca

SHA1
53a57f29c9b25c6a803360628dfcf803d8a30a2b

SHA256
610c325ec4cba8b297193892b4f91cc1fcd16e635442115e49ecaf64a5c981f9

SHA512
db49d1e5a2cde6db502620cdc838ed55dc3f22e75a0757d9bb41d4a7f551bafaa93b365a7323ab61f50067e19697cd172189556acab64bf30afa711721cd2dc9

Download Submit