7e78e084a9eac2be379fd1089b96d5d0d4eb6469f2161a0c2e54ba1ac7e95c79

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcb1685c450d956a2e09b917dd038a7a_JaffaCakes118.html
Size

82KB
MD5

dcb1685c450d956a2e09b917dd038a7a
SHA1

511ea98cdada49dbb38b5ccfb969d13fd9e87c88
SHA256

7e78e084a9eac2be379fd1089b96d5d0d4eb6469f2161a0c2e54ba1ac7e95c79
SHA512

adbec8668ab7072b99b08ce5f9194eb9fbe68169192e4a8d9074809e18806a87fcad26c2dd713f71fb95d67e75702a3ef7bc572b7a85edfef95d26b55ef5c27b
SSDEEP

1536:Pb89pawq2H10KDgC2QT7FZtg2M5EJGhxahlAb/+HxJM71RWbIBUM0wUnMiysPw+w:Pb89pawq2H10+XtjM5EJGhxah6b/+HXe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3944	msedge.exe
3944	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3344	3944	msedge.exe	83
PID 3944 wrote to memory of 3344	3944	msedge.exe	83
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 4132	3944	msedge.exe	84
PID 3944 wrote to memory of 3500	3944	msedge.exe	85
PID 3944 wrote to memory of 3500	3944	msedge.exe	85
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86
PID 3944 wrote to memory of 2396	3944	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dcb1685c450d956a2e09b917dd038a7a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d6646f8,0x7ff84d664708,0x7ff84d664718
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15828962694937808191,5099943229426533026,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
f9a39bc7e7c7b2aa5f441553e451ff57

SHA1
4975e201b154e5f0027e39c087290a6c48e4f834

SHA256
465d2166d628423ffcc407cf686ef4b1cc8f91ff9dde867e80f6b7b148c9363f

SHA512
0089a78889bb1c67f12e7e4ee4820b501499c6f57f734e760e621a55592d6f0064190e3def6ea9d0d5af2b73eedf65a47c8930a471cc1f6908858a73f61fd37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3c20a2d55447bd795451b7d922933cea

SHA1
96a6ce248b5ea7822328723573d886db922526fa

SHA256
20c8b8700e716183bc6d0c13900eeba5cb84287eb3700307a19476bd5fe4d729

SHA512
db5babbf5760aa2a8ca391a60a48f92385b242409ceaa7a5e73a53939eb0ec4bca76904bace35f03a85066b171bf78fa11277a97d3560187d4a063398815609d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
99d752672fddda657a05f9a0ad0ea968

SHA1
aeedb2abf21b2d9d90941312d123fb31036ef890

SHA256
0e2921a511e117b763c9bc70c85bb6cb758c2e5b0a7b84a10471b9ba22176c78

SHA512
6d7abd2c3d093d658e47be0be24c9a105b2fb6236c864d6341c46986a45284dc52f2127f77e4c911891ba41d7025c7a45dde098ad9aa12cbf558cc340c8e0178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
af0878e7b446d10fdd3a2c6bdc1fb717

SHA1
c6f457d8c957e4cb548dd965ef0d0422651faa86

SHA256
657bb429abfcca790a400f40bb38362f3c96034ea68f2ea607eb3c3d22fea610

SHA512
652c4d91bc15d7cb516dce2c98eadadd98b0156cc733a7ad6348e887e5df43ccabee0910deb1d9769f596dd2e5ec4a57f0b189fb12187d943d0c94cb811ac15c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
808ef8d9e4a4e147c9421057d1d65b20

SHA1
32d5f2ce080fee327171590150722803c4ab3c65

SHA256
5bd02ff944b2eff1c96f1bbc583e0a6f4262a00c3a1dedef6866942a620a95c7

SHA512
17261960264a81e8dff5d876992cdd77345edb7ed4a52507ed9e70e1880395224619d81384f09faf4c7008763055c4f06837247adf48150bde0c3014badfd718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a4c3e3d45a66f05d2b57e92e08e387c

SHA1
edfb7a1eaccb7f684c5f25ec8982fe2f5d7471b1

SHA256
b3a0d1a4691c04014eb674bd7f39a2540cf86e716554c799527f4468f0adee8c

SHA512
b5240a59751c6ff09eb4cd7a3f76f9e1c85656c94143b40d5e6f87fac569d185fbe98cf5cdf560ed1fbc81b071d1965997fdc75712c50f5dabbb857d924c28b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ac035326a385922674360d3664ad04b5

SHA1
a342de9499914fba80a286c0a28dfce0dbdd5d0b

SHA256
a1a8076bdc4ab65366862a682ad8585f839cc134b0fbfd135ce8e6654227c81e

SHA512
1b4b242118cfb5cde040dc6eb6b4aa697fe39755a53e1ca88851e82ba045b9b33599318d1a1f7dd619912e6ec263c4922b25fa5583aa988a9be08ae9d8f82cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6921524a464654297f685fe0784cf16

SHA1
d7220471aec65da54dc4b5b2811f81fd849a8dfc

SHA256
3acd4ba8ec02d9380bacadcc7a39f655814e3f878d980c54a5b92df40686ba1f

SHA512
ce9f632467924f16392e36d2ce7cb04915dbbaa534420ff8dc2c273fd58ca977072e2cb7bce8f33b5d0c5484a11e01ddac5085f47ba67d27aa209c259b062799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5858aa.TMP

Filesize
1KB

MD5
bdfc0d0d0014676a16703296296dc062

SHA1
c8cc684eceefaf8789efbb399b8f51afc985f0d0

SHA256
b5d987484467ea11814c49c3dfdedff1e260ba5fba6a16bb72ba517ed724b793

SHA512
5d34b4adb17ee8a6ce275c13f2f3ea892e0f6806390dbe4ac0dd13b52ae161a90931f44f472d562f780925b6dcf3d7ae77583188ad2aa3b32548e4cff6ee08d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
abaa481d95ef15d12556fc56629db608

SHA1
d26336ae7028e9e0939ac0bb058d4d8a401a64c4

SHA256
5c557e23e6f878151e09b8f918889157648b3e1db67977377907c20bcbe21bcc

SHA512
bbcf55a10fe70e128bab44862fa05808d118264f57752249ee86ffa69db949c3590f3df5fe19d500d1fadca22185ebcf051864c0cbf503cc78c59b9ef127b933

Download Submit