d66d618ab98720d07c773ba4db97aee2db68bd797151168ce33b40778065794f

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

081cb9e5f6e9944e77154aa53c338bef_JaffaCakes118.html
Size

18KB
MD5

081cb9e5f6e9944e77154aa53c338bef
SHA1

a7b2d0b02b88073e08bc776aad17430a603325c1
SHA256

d66d618ab98720d07c773ba4db97aee2db68bd797151168ce33b40778065794f
SHA512

a08bd17bd0464ff6b75f7f9cd11fc45e44b8f845ca8f0640e63c482b0edbd56b903a4cf1d0f3e69775b02b4b6303ff188dec995d112229617061a6d4eec50545
SSDEEP

384:SC+4kEWeKzwgEeeZEykWQ21PXSv0kwrxkwB7Q31271Fjp:SCvkdwgEeeZEDWQP8/yliTjp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
4440	msedge.exe
4440	msedge.exe
2468	identity_helper.exe
2468	identity_helper.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3876	4440	msedge.exe	83
PID 4440 wrote to memory of 3876	4440	msedge.exe	83
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 3696	4440	msedge.exe	84
PID 4440 wrote to memory of 5080	4440	msedge.exe	85
PID 4440 wrote to memory of 5080	4440	msedge.exe	85
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86
PID 4440 wrote to memory of 2180	4440	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\081cb9e5f6e9944e77154aa53c338bef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b22a46f8,0x7ff8b22a4708,0x7ff8b22a4718
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14499802772009002881,4845106605339550551,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
6d7336446e33064f37c6ab34128e3f12

SHA1
0966860c70a189bd07ba867dc9eefb57cdedd70a

SHA256
91d64588cbcb8ed66c414a68919616c13f5594a209ee58dc30bc8e6ae0223614

SHA512
6865b7a946792a56324fd9d1dbab0cb5349fc45f8b33d57bc3337bb0658e03751484e2c1003e0247c9b6900032b357c2dd625305b1b4231b40605618c23e90a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
54c1e194911d175b46870b623a44c3b2

SHA1
f5fd072fe6ebd8d1ab26e5d76105354a91e1e2a0

SHA256
442e27f38e0b1ebd9a790381f51b632ede1979cbdfa46515992ca85808ee640a

SHA512
89d2d958aea5409d2e41bde15cdd1b2e91353678dd05ed880dbc28a2e799b1e5d5107dbd20b2405460596cd5e20de0a2fd2f25163e7058137a8eb24127c05448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
57dea8b2fd1389096df6cd1ce867e727

SHA1
3727ff1322d0d4576cde6c6a9dc8492dd861816a

SHA256
c47ffad61a8c1a2c2e2273bd85a7cb7a77ff374f6d103f8dc0d4b719fe29033d

SHA512
cc53f549e3871eedbd42046a1a6cfedf223f443f3c1a5732b8fc535582572ef419afbe67780ba1ea600d819a355895b99143b46026c7ae4979342be4e24cecad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8eb2ebbee133e0c36fc45c94c3a4dd9c

SHA1
d59f530d25f5ddd63a2c61900f4d7f5b2e4be913

SHA256
8a2afe67a2f87587fa3227582b2d46e80bb5209adcdded8f94065d79e84dafb2

SHA512
4a1153b10773cc2a3ad0552c357f8a12bb445404ce1eda0bd89cde190493fca53b17ddba854d5dff888efb4acf08776b9f9c1ef54ff2249e998ca4f4bf51a0ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dab36d8df780aa59dae77612913493f2

SHA1
06007ef4e3720d2d7c16a0117f7cca9f5ecbd4f1

SHA256
3ddc49a7aaf64e8a199a7df197e8c1a0e1ac6c912a0752f24aa5f711956168d8

SHA512
a734020c694b5d744a9026b84d68c80a08eb6f76496dd6417a4ac688ab474e47d5e0b1631821d83ae6878770c97b4029c2e052adf501c00f709567daedb430fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d80d007323dae54e8cc0c06322f124b

SHA1
cba14c356213dbfe1c506461bd32bf99a246391d

SHA256
1018ce2a5204ce7d6a5d9ce98342cff5757466ecbfee147eba271cbecb415b17

SHA512
3e3aa3c757bc0a8b9332c82b6fd8fecb7c1956d59d9b89715737e96923908af72e0b0df530446f27b875d37cfedfffcd9308e487618e2d99106da6b0f208bdd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55fe129ae300c80f71e979e956b27b25

SHA1
43d046144a0b1fee39a080dd45e5d5865f43db19

SHA256
9b6a34bdc310686067dcbbe427977ab6f9b96108e6854904b30e396fba5180ad

SHA512
97ac35df2fb88e0a1e944b9b2f91e2981903042d29086cc3d8b5b978b414d7e7976e3f792a079ee8ca3419554c6479ea11cd73340acfdf2df09ac2452a7f56e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
695845968008a97f17e581b0757305bc

SHA1
67af726ee412082e00d1e5178c16e74fcd4e7f59

SHA256
1cd318cc014df6d86115047dd0436db7a02359665fa35332c437b4e9d894aa34

SHA512
98206ee8f847aaf7c76bdc9d671bd3adae14575cf2d2757bfc0aaf027324ca6b571f2c387a32d5959f5b879df34eede9ae616157cb403ff6517d8992188ac516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581bb1.TMP

Filesize
704B

MD5
6221a2c07f3000e8adc2ae167d9f17fd

SHA1
bda98a9d776a8255df2000ae2a1707f571dcfbee

SHA256
ee38aac4efe430c342f3cbc4018c8246d1253e110dee9feff4dd47ac7ae81a6a

SHA512
239b5b6bc5c49942ed856aa8710b05de8210dd112038cb52c6e3242bf6aa0142c738f51d7d1ff001dd04fb02239f972a83d7caef610cdac0220ebfa28c3d60c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
35c05f6e2433f586bdeed3259d9d08d6

SHA1
e1b1246373f64c4ef23d396014224b0b2d04ba82

SHA256
b5364778f16e91d717b3c4efe51ff5088548d9a1b4e20bb8b1580432cdd435ba

SHA512
fdcac3b12991df70b0465ce4dfa8a92222ad681223c402b71e991391c87a40531536373f95aa9d8899c94f26c20ccd01d3a963f96b9c419a65f3d81f84a58bab

Download Submit