0945931669ea18cf6c0f6b75e2e9e5dc473d7eb7da23424f3e644c481d01f438

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dee94838b42d4fa049ca73033b663050_JaffaCakes118.html
Size

162KB
MD5

dee94838b42d4fa049ca73033b663050
SHA1

adf9936f84fc1cec00121534c996b9002f2ad3f7
SHA256

0945931669ea18cf6c0f6b75e2e9e5dc473d7eb7da23424f3e644c481d01f438
SHA512

8f868baad2ae44f36115138e3046f3704e5f9be8fd4f02a93b92b765fefc6e5db85ae93f3051e33342a99df3eefc3934dfe8354688d0a2a56a6108869040f68f
SSDEEP

1536:QpUYJru0sJRjZyDStoibovSPTBioegjxR4Su6Oo4yoyosoG2R00M+V+A0zu6JA2d:QOYtu7jwW0gjnEKJmQ3CC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
2936	msedge.exe
2936	msedge.exe
4828	identity_helper.exe
4828	identity_helper.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 804	2936	msedge.exe	83
PID 2936 wrote to memory of 804	2936	msedge.exe	83
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1252	2936	msedge.exe	84
PID 2936 wrote to memory of 1148	2936	msedge.exe	85
PID 2936 wrote to memory of 1148	2936	msedge.exe	85
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86
PID 2936 wrote to memory of 4088	2936	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dee94838b42d4fa049ca73033b663050_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7cdf46f8,0x7fff7cdf4708,0x7fff7cdf4718
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1268 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6511540495486073880,11575159802970797895,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5548 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
0269aa8505bb39fd5bc5050ba149a7ca

SHA1
35fb0d67b39fd562b7619234a7aec57d989fa325

SHA256
c8e7ca64f3cb3023bb541075d3164ac402b1b866d6ad4ead0489694bfff885dd

SHA512
532eeb9852390dfde8e14d73b40461faadb0ae3741f304807c734761d269156221a15a015f60a42d537d221aa059365af1d112d184ca6a807d419230b2a32cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
31676b8f8cdd7c2a0716f2a5e07f21a2

SHA1
4d5ea72dae94825ab3a9bbd6cfa2a5707a8f3fa8

SHA256
bd38c21593f960d3aeceda3aed35b6972147b690cf5809378a83ea98b294767f

SHA512
86e24f4e5f05849dac17d14dd4948a397f376b2dbb784bac7178cc48ab8b9da662a9da7c67a6053f895d84e6cd2c472671a4b9256cb8737bf97c5796df27cc6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fbeca26707538199954e5d6373e25d65

SHA1
3e96d14653eeb10c3765d1ba5460bbbfde966d4f

SHA256
e1d57f8867c904028f998ed0ca22f7afa48cfef381d7d832a226e891adb0facb

SHA512
8071a917daef4100b14b06afa4b07602db206ce84c8129a4bcb925dfc7cacedcca300fa280d3e3aa9be5c79dbd89f906da05e078cea6b87a98fee9785976b3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6fe8fb2e70dd0b42149a322561c85ac

SHA1
d35a1c96a74ae78f0e04b78858094759afc7ba0c

SHA256
ddc85ee00b4be6e423a9ab851a5c57e64eb2fc34c99c18f6ad68cfa06f642158

SHA512
c01cd2431283cc2c8432e3ed6b457b0f36bffc34ff05687b3a8f5c110f8e01b8e85227275385bface9ccde5595e273df1dcad00b76eafe0d30a8acef4126c7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ade001319b9e7df648ee5ea74e7d4e72

SHA1
dd28869110c83f39e2138933ce6968279aa06ddb

SHA256
97a98f7434073d233801e06c084346a00a5029789f199cc10bc960fe79aadb0e

SHA512
c7db2b3e95450ef8fa0486319a9ee14b164ec62a6a7d24c5ca4dc6e712118ac1601b964c9b5367fe86428279a42758c81d265efdb8845f1f2f3f80a64d0825d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1da20a25786d6e0b7f04869b98bf3f03

SHA1
fab35104a9bdfe9ed2a1312dcb8500276962c72e

SHA256
01998a6475caf08bd88821513f86ec8878a7b6c2c8bf762b619e7e5637bc6b7d

SHA512
9352371651295b71d5ef506c9f183cbb60262ea2f678bf8ea42900d7800d98a8234ed26d23ff53bb1c835f12eee3b9cd9f445b85b8f5c63356c9d93a86fc089c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0efa399b31da6b1c3bf416395db1b98a

SHA1
d59f43d70d1945eea297757ea8312a36f48f96b5

SHA256
549b099045fec77d8703ade04271fd7df43ca378fa28527ba7a7923cee2b36f4

SHA512
fc7e4eb47e3bdf4bbec8c7c51bb106f596c6e91f8e060928c6ca740a0bace5d72e7319c37b68e65c4aa14b07f0b121a054424b5cde70d0f9b7f3ba92c24cda30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
820fe1758a5179e039726826189fb397

SHA1
29a4ee0f61e4d0d1a19123a1cd8cc11c981042fc

SHA256
79b2b3dcc9e36223ec6a4b619c38552fd13a446a45dadda961a482c153271c6c

SHA512
c59a2b7fa7ea022eb899de86b43476236e2e2a617337fd33c1d8141650d53cea0a86b92511e4462d4b13af97c724746a6c9acc152a4f0c76bb31941252e5f33d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58534b.TMP

Filesize
372B

MD5
682fb529c6deda37cfdd0392586f99ce

SHA1
a42791c5b97014b8dd6f08ce1130de8911c1fb53

SHA256
ad965c12b4bfdcf7aca0a1ee164221a4e2e54a35f129740fb4971f854638ff03

SHA512
6d59712cbb8899a357b64972e46bc362911eee0e6880ba28586d0eb4620d5cd6e8917bc332e2f7378f0638274771ad8b15891946d4fecf7bbebe78cedd1c5f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
33368e0a7790b0bc039cf4ff6abc74db

SHA1
393ca7907bf35e170b33e0b2e393fe09503bc39b

SHA256
ac043918032e40be9a3e4a486e2bc7ac499cd4a3f3a6da3b4c907e24b515ef39

SHA512
5917113da5092d03342077d469aacb298c1bee3eb03816d12629781e0c417b2b814e4958444b9dc8e604c631cd04a05eb07ee142722f2f78cc23b788fc80d5bb

Download Submit