488004ab55b8255732cf0e9602e25dfdb2147f119de88d1e2f6581f2fabdb158

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da570d81ff29fa506efd24f1035b9b49_JaffaCakes118.html
Size

82KB
MD5

da570d81ff29fa506efd24f1035b9b49
SHA1

fd8c1c2d6d37ea077581ada8d48e367660162af7
SHA256

488004ab55b8255732cf0e9602e25dfdb2147f119de88d1e2f6581f2fabdb158
SHA512

e126c8de9111139d303316be582a29d8615a829254865455d0d5d8b8b6e32cba68d1b7a7d619dd29f8a10ac14006ccc6906519cc4021d5fff04c5b5f681387ea
SSDEEP

1536:qkAKvhVBQqJ/fFcpJKBnSoV2mQcRUr5zDPDlqPkYKOuhlR:FA09lnn2mQcRUtzDPDlqPkYKOuhlR

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
1712	msedge.exe
1712	msedge.exe
2936	identity_helper.exe
2936	identity_helper.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3384	1712	msedge.exe	83
PID 1712 wrote to memory of 3384	1712	msedge.exe	83
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 4832	1712	msedge.exe	84
PID 1712 wrote to memory of 2432	1712	msedge.exe	85
PID 1712 wrote to memory of 2432	1712	msedge.exe	85
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86
PID 1712 wrote to memory of 2612	1712	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\da570d81ff29fa506efd24f1035b9b49_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9568446f8,0x7ff956844708,0x7ff956844718
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7039042192253190791,10495072452819235436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
504c509e7ccec111dcb2a0736c9a5ba8

SHA1
6af2353a0d05f0c7ba50f0f93d90c241cf89c146

SHA256
27129ac0d6cfe983d48b122664cc88738ca59225d8d352486d680d926e92614a

SHA512
3ee36476c101cc14f23089435038575fd2a86100d2b88afb061728e84d9faa428eef8a81a71c86992096f4b7bd3c0aabf5d0867766351eb1466306459d1d0eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b4076dc3abca9b45b5b8f6209a16274e

SHA1
3e408a91b24ec65b7c9f22b4720eefc6a8685bf0

SHA256
0c2b40bad0031cfa758062da11a2b9d4fef5a365c4188fb18e9373ce30243d7c

SHA512
ccd2e444152a9245f51127deeaa3854cf5c12f96cde0bb05ca1cd75b14ed093a4d2066d9e8bc1c46a501b94741761aed1d8411ee319e5e10dc29427ded732f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
00b64b5119070fd2515c290017da6131

SHA1
f2dbc8856c9a915bc2d1870aea56aaa04a7297bb

SHA256
4902dee188ed493a71a3ab5399d2dd5818ce9211df26046d228c42ace924053d

SHA512
30a0d6a80cb462ad037c8c4d9e139a77248364dc197ef030539dd22be92becc7deaad0365b73fc74bd67c48ac67fa9641eec097609de3525c89071ee6300754a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1c0b8efc59382643ac736ae77fdc0dee

SHA1
ed398e9b708169c1fffdc97b467c32c7d7e42cfa

SHA256
10059d392a945a2a359d090c542fcbbd667aef2d8891cd8dd6e3ff62043b6464

SHA512
ce1b5a5cef81581db844c6c9f96d78b17e1079420c567b7d9c4647f388990d8c12598ee69efd67a07d7bc423e810a5c5735ba52f61f7e0ec1f4ddd656851d139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4b79a05baf4432aee4697aa1a2f50c5a

SHA1
d18aa5a4bd53af5eaab010ee939585bd3cc5aa6b

SHA256
1a62645225dee0e92a1b457b5d66d0107317b8c6df65cf59a0841b96ea3272c0

SHA512
d69a28f34e4fba044f54e2eac68e0dc2d1958c8073bcdf960a96653d4e48eff13a90041d6b1f15462adcd4872161883c8dcae4966a976b32c0216b964cae6227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a76f4cfbfab47da1105f53502ea457ed

SHA1
fba0e28aa7ec0379babe4d3480e76c66a69c3f67

SHA256
b94b991c8abeed8743c0564275b8848611bff046e34b584ed938a311627a35e0

SHA512
aa38b0bc8e74c6c6c362fde318aa4352e61f6f7049cd8f385ce1d03f0922bf4f9af500ba2e1cc73d3f8bd2f88758204f46ec0f7edd0bda9bf21c74eb757324f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
64d62cd10737b503a52232ec2729cb22

SHA1
f91e92aaf615b6d8b791254debab0d4e43d5c37b

SHA256
2b6ca62d7c8160c1a0a10269ac8aed08c857a625ec9f945d7aed0e30fb92ee93

SHA512
d70e7da032b57d14da64b4d874a87ad98aa9d41b1d8402409ba44587987f9ae52d56ea3f526d9957d077c8b83a0e5e80074c9eda2c12ab6cd5ee754a7c1d07b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04b6bbbd56aec724e7551840a97c27c6

SHA1
17ad8f187f4497dc7c8d348ad6de4cfa0780eee3

SHA256
f8b29f6714a8f9159f557bd2794f147799e5c80cdb925a8c8321f8d901f39dfc

SHA512
34ace2f7ee09261be8c81501060a4659f7485a8d9ec8a6c0b9831eca956b19ced9411242280076fef3cbf316d588f515d48faae3c984b1b374dcbab92282fb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
2f61e7505a0282e7e2b468e5eec41a5d

SHA1
817a66255d9e189dfc4d317eac48272fe108ff35

SHA256
a5360ad12a48b2296faf63ccb7e87e284a886412cf99c6c31436423ac96d1013

SHA512
ae87b6a9bc7bb825e2a21d66ee4c9bba3ecd1c713fbdf2ea6cef84e527f6ba9761d081932cc2c5b45019ec1ec3c5c664a70cda6f014dfaad37279ee79b96b703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823fe.TMP

Filesize
539B

MD5
00efe9f889a8c2c10a6fda86ba688983

SHA1
1a8a817603f86ddea9920ed7dac6a5526e5eaa17

SHA256
af5233d0ec6ed9ef1920ec0d1d242c4bf8b6c8f5095faa6ea0e867cfe339b3b6

SHA512
ccefb9e9ae86e57c9a579ddfc703855843878195164a1ca6de03bb7424007b899ef9f43045223cc5c8335cfe7b0c16228c5834632a40ca46416aca4ff3f750ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d0ae4982dae630f6314510182e5dd1e6

SHA1
e0f6af12ca524ed84ebdb075f18dc3da6b61ca56

SHA256
c0d93f56fc996f6046efe330b1404f727041843c7ec17770b5deab38ff1fe9e3

SHA512
23c65ea1b24a1fa1f5afbcf262a9a66c7da0014d318a3e9f38b357d97e883de2283a2a0b44551f91e58b5b9843700dfef82e8238607debac83235b2ca1154fdf

Download Submit