3b329d00f0f6d2cba83835676b3bbf6025cbd193c43ff6cdf4b2d01d0de5cc73

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff220b4489f96431001fa4dace7a5bd8_JaffaCakes118.html
Size

26KB
MD5

ff220b4489f96431001fa4dace7a5bd8
SHA1

be1215cbd8a894a09416295c92d219c496a2ae30
SHA256

3b329d00f0f6d2cba83835676b3bbf6025cbd193c43ff6cdf4b2d01d0de5cc73
SHA512

f7928930e39da8263355cb21eefb03be132239ae88f04ca8a2fda2b0c3ec9fe18c86049a1704c3c19ba16d318df4738b6c8114a17e50f752f9e8cffbad6dc0f9
SSDEEP

384:SIywwTRxbuwn1sg+yqRwkTcjb9mSpuZ77pCKas/uZ7zYls79Jp+K+Jm:S53R5lnGg8RlTcX14XpCRs/4suJAnc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
2600	msedge.exe
2600	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1916	2600	msedge.exe	82
PID 2600 wrote to memory of 1916	2600	msedge.exe	82
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 3900	2600	msedge.exe	83
PID 2600 wrote to memory of 5100	2600	msedge.exe	84
PID 2600 wrote to memory of 5100	2600	msedge.exe	84
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85
PID 2600 wrote to memory of 4128	2600	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff220b4489f96431001fa4dace7a5bd8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6772085738153373051,3093239075421803937,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0517fec53e0d911fc482c169755ccc7b

SHA1
31c3948525c7756a2d635e48899a563a7d610c5f

SHA256
dad986e26447a4bc3bebb793b0a45193ea2f06464e03b2cd696556ae16cfd348

SHA512
fb64c0a7a6b7630cf259ad7f6b490045de8067cc4ca49e47c97eb4f6db2af94ad69c04ee39cd39a0d9b03467b66ea0649e235cd02c483d58455077feb88b40c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
104251b1d9e64de84b341267e4bf8a9d

SHA1
22e7ca3b17b2f267d8fe1d9a7198f4ec9f0f2105

SHA256
d23dfabeceeb8a826a741b752d3e7ae45d97fb1637ef926496367a6597cdd8f6

SHA512
4489d8f70f7a1db5b0421bd64ef9571391053a25d599d35057de21b297588da8a742872356d3a68bb7496fbd2890b1dac7ae03489f0c193dc46f7d4a81f5d99d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ca4038040d3e2b07d79a3d9fc2e87add

SHA1
2b0d2590eff10048846d4aa28d7f497cf06fd7ea

SHA256
a0af60f56592fce7643fc2761d64cb679f6351549fcd5f2a9dc068a50a3885ca

SHA512
6198152da40bdf9f688ec824371c75ad09f544dd8a1f752f524349c495adf6c73b6156339f8da58148b961135500c1d5e62d7f98b5377f44ab392cfc79cf3c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
349c4f5633ac68a33ada106b5e1b2b80

SHA1
6ef563935c1f920c7a4cf69e7359bf2c96368b3e

SHA256
7231200424965937cca1f84f387cbbca9b711ebff952f34ba2b0cb0011076415

SHA512
3279172b240cee6ec3cc3b00087cf29782d461b7e51a399a0d6e27d01051a7ca3eb318b572d9d85172bdb92a9d796c744d50611e4509d92c358fd5c6f0464f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a5328694facf5fa741495c24f255180

SHA1
16f8e0e5f9dc0edda1fe8e676986d2d65bc59f28

SHA256
b92cfc856683a52297eea372620b4d7335c8ae2b8bce2303754e8d82e5ef97db

SHA512
5bd51b4d231c93c4ec8ad09c4b8a1636108d1fb337c0da0b88f84c509c4448a9472ca7842620803a2a42a124e2e11da735395525f4aa27ea2727c18d7dc1df28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f1e1827d127152e8d3c875b982aae0b

SHA1
291ad2a44ddf174dddcd81e10e0bead06fd054bf

SHA256
140efca8a1bd39030c592a26328e180438856bb44c65aeed79a388c462fba84b

SHA512
8d14a9066ac829dc9c0c192c9cda809417f28f6cb26b5ec5403707e43474d11bef96daccc3a445362cc9cd7bf2e957435d2081eac208cda0f1d7f3db622e3577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17424eab9b4db3e29aa9e5c098879aaa

SHA1
e7f9ee741d321a882e3d90b5c93c30809b9daece

SHA256
6d0e2999dddd88147dedb176389f584ff509478074250b408d49a600dbd9418d

SHA512
b16c5d774ac9904ae30a1c347de620c07931cef11e1b5741772925cc082216172c8d02e070db34ddacb0dd6635a8e2b085900fd78a5f27ee5d61174ac827148c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bc87dc4cb950d67e2417269c8008d8f9

SHA1
00e7adb3e5ed25d254e74c6d75ce7b8da8015dfc

SHA256
383f2f78affa963eeb7f7393957239eb0beadfa2b8f14bf11c9d6cbafda68ba2

SHA512
2128afb3ffc1b5876dba57496d3ff93d1275a3524499d2a98cca458e64ad103eacff7a2b9b5e4a0eeb8b59a412ceed1f0a32058cad3e2cd7f82d1e581db1c510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e985.TMP

Filesize
199B

MD5
a378cd47518eb64b18ca7e1161d7b4d3

SHA1
737123f71fe0bead0213d0051a6ead46e1e4009e

SHA256
80022446a6e8c1d25cf0269a5fc48aacedccc6edea9fcc6cd9364a71fcbbe0ef

SHA512
c099297aafb3a14bc0d3a2617e0f3903d63599174cd0336fcd3ab6ffebcd5dc7f7424a7e216160ea3b948221f80ce709a738f51fc5c7b40ed67ae98064da74e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bde5c1ae76ec0c7f1304ddfbcd11ff8

SHA1
be2e4257b21f931ae4af4aa08b92bb8ce86cd3aa

SHA256
53082d890895c726e47c94230121fdd3cf585f72c34d157de207365d1515f82d

SHA512
47da3905a19b7433f4d3459109fc51383282d2f148a01a9099754e344aa01ffdeb6c3c324abd02552828cdb74f258152571bc6b982d5c8a763804d609864b6de

Download Submit