2d0c8e4ff1deda7425b3e5e670b655ad8ea394ea480b0a6bcbddf2f6acd44a94

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac22daa4f674df14c0e1d6a77a33e8d_JaffaCakes118.html
Size

74KB
MD5

eac22daa4f674df14c0e1d6a77a33e8d
SHA1

7dbf07521c2d99156cb53c0e529f3e3394d2666c
SHA256

2d0c8e4ff1deda7425b3e5e670b655ad8ea394ea480b0a6bcbddf2f6acd44a94
SHA512

d4d68b02de7719102c3e141da3f849c84849fb0fa0ff907038fd2349f7a53c0b98aacd0e3b441d4d40b53e147918b8fda6a298a1198e98f9d90b448890a0c08c
SSDEEP

1536:x3HH2lDlpz13NztWGSOzCzt8k9Nli9IKEsYUvlMX9iJlqKRVb:hHWNXbzlezt8aNlFQDM9ixRVb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4616	msedge.exe
4616	msedge.exe
4244	identity_helper.exe
4244	identity_helper.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4696	4616	msedge.exe	82
PID 4616 wrote to memory of 4696	4616	msedge.exe	82
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4720	4616	msedge.exe	83
PID 4616 wrote to memory of 4252	4616	msedge.exe	84
PID 4616 wrote to memory of 4252	4616	msedge.exe	84
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85
PID 4616 wrote to memory of 3852	4616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac22daa4f674df14c0e1d6a77a33e8d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c4a46f8,0x7ff91c4a4708,0x7ff91c4a4718
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14119874870413740187,7911547385871019797,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
3f4c7cf9cccd3d63da8a966b5b06809f

SHA1
3774fadc6b28c707033f06bcedfb728fb313d37f

SHA256
72e5e2386be99968367d35621c0ad6cbb3e5e17df07d8cfd8f2d5bb507a44ef4

SHA512
93db8aec3ece95edb6488ae09f005da6a2cbd8bc91220ed71deadd41323c85231333252a15ea3a794f8ae2f87c186deb9bc16d085cb6ea0589d88d4e60eea84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
fbba2b4a9723d65b5de22c26009d927e

SHA1
7da1879e073b636afd957efc0d379f7bac422534

SHA256
c72098681c753912bbbcdd34e53e054c178360aca2498981457fabb6b6b93389

SHA512
638e13493085cb5dc86f9b5f3cee30c9b8386d16f3fc736e38d799919d02a8528ee6793c2595d32c80e6ff6d4beddf6c6de4b2c14ce70b36e01cad4e94018623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8168e6eaf6c1f68038e3c4813c25ce5e

SHA1
2953da0a892054cf6921e893b7feaa7d523fef0b

SHA256
eec2720dbae12d8d2bfd1fca950c9826e294ee72476c358e3f25eb86c2b36214

SHA512
cc15e1bfc97d1d4d3a09b7d83843c5746b8483ab217b2de8f899aa4f3edae1c3286169219e7c270cb62f9a40caabeb7b0a071c7c12ebc2987abafce558d05939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
996f5b005b9dccf66deca8c67497e52a

SHA1
dcd0811cdb40396c9aa194b8efa689ac84f5bcc8

SHA256
6a467b4a610bfc7e6337185cd74521c3235909c73a928397e5b5d824a3bcda86

SHA512
5655c5ce0b25299288aadbfe505805aadee59a1fa30fccf80117d93cf164472f7696e3bdd9f785bb48604a0ab1c0b335ebdc68b37621d9f7fec32235b3467856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c2545fed73c8e0f8f8754d3cf3eac20

SHA1
e12b3458312e4c5d86f9fa4f84051aeb936e73f5

SHA256
714d5e82694f8239d00d954847faa72879c7ccdf328b8d7061c04a7e921476e1

SHA512
e04a9e485ad2ac7819a079997880027ddf023c6fe3d4d265986c29df6bfc13036d1b6594e68ad07d160e40cb2dca5e06e89d273632f2f8a092c3f9a3e168eb54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
983c7a8bfa23c2ce2d86e2f9301ba53d

SHA1
c49f56ae068ccbcce73f32d1e01fab5397daf199

SHA256
805503a76450485334f488ae0cfd6406572490b29274dc558292ddfe38c855b5

SHA512
ddf4550d076b5f4f417bedd6709358363ad6ed5d4f8badc5077249ecee14b92b64285fa7ae83de79fbe989b55c2efc6c4cd2b6cf3d932d3f881e82f7a3176e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78c0b9eadddf13e783d92dbd6b7074c1

SHA1
e9c818b1fb5a32a2b7719021f0a309ad27ba02ae

SHA256
022121ac77143f69b055716bab9211722e59a7cfd016613621759d30a4d4e16a

SHA512
da9f04c1f2a3cb52d1bfc82031717fda62a25866b45771c893dc30ef749b152054965f25fa31d18613b9277146799f0b17ffd933896a85e6417ab86b1aaa482c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
2e22621ff7757c525a5f3e4b924fbac2

SHA1
1979d840d70b8831908c31f79445099c71419458

SHA256
f606f592c6dbc8b008e729ef084b8d739057aaebead5e2c03ac322f77a4e4484

SHA512
28e29d002647c8224901b09db06b85d0baacd872f2feb2d9e2318c9b28dcd29b4d5080832f5630f7cffd4a9294007a5b776e504fce9865cb4a4472b415d1fd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5835ff.TMP

Filesize
203B

MD5
7fcff7d94004df739dfcd3b484dfbdc0

SHA1
0e664a2a8103a9a1916223a84ac799916bdbf3b4

SHA256
a4908e0b1b00620248ec5f34a5695c65ae4f298d8ebd59db9eaa0057fbd933fc

SHA512
b84ca9a7aea3a25c9912242e08db8a85f162e986ae6faf6f2ab705aed1a14b67c6bd75e077beea12f2a60cd1a8791abecc4ef4bdc17673966c7643400a5ced93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b995de4b6c8c7123e50b2c85fc94011f

SHA1
95ba6922472df68598abcba5e97a2d48d1f98f2a

SHA256
6afb565dd3ace37aa71e5e5a34fc9dece7d8b25162c30420357dea4f3e5aaf18

SHA512
49f9d4c8bb0a9e8776c349d57ad459e4e0077327f2cb9d9ee566a646bd139a45abda93bbf1a84762439ad097f16fa919fe0b37a186f7a84a678a1ea7b042ce94

Download Submit