d3d68766f5fa908f0781dbb31e4783bda49c5a1eb383108f90578b0c9f5e7c68

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a225fb1dc0d78cf4d8299a3efe394ae_JaffaCakes118.html
Size

23KB
MD5

0a225fb1dc0d78cf4d8299a3efe394ae
SHA1

3eceaf0cd3051e6f0214d309315d58a86dd894d4
SHA256

d3d68766f5fa908f0781dbb31e4783bda49c5a1eb383108f90578b0c9f5e7c68
SHA512

a639408d968a1b840ffea1e33af0a14472859921f892e3a68be8fff248fc1f3e02c11a9348d5aad6ac7a4513c04c673df116095a09cf84a06142cfd9dc7eb25a
SSDEEP

384:BdBLohYbz6odwPaBhw8VQTiiVnw8/jIB0lBMUFEdM792TffEM4bz/cfAJ0:BdBLCoeiBhw8VQTiiVPjIKlCvM792TfD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
3464	msedge.exe
3464	msedge.exe
2260	identity_helper.exe
2260	identity_helper.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 944	3464	msedge.exe	81
PID 3464 wrote to memory of 944	3464	msedge.exe	81
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 4688	3464	msedge.exe	82
PID 3464 wrote to memory of 5036	3464	msedge.exe	83
PID 3464 wrote to memory of 5036	3464	msedge.exe	83
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84
PID 3464 wrote to memory of 1008	3464	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0a225fb1dc0d78cf4d8299a3efe394ae_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe024c46f8,0x7ffe024c4708,0x7ffe024c4718
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7599489496890595881,12891256037920160661,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
047d8ac17db360e39b3b70239f5543b6

SHA1
ebc6dfbf9192221c6657a04ee3b43a410407cc4d

SHA256
6f36ee3c2102206e295b1cee167d200196778b02970edec0875bec2227a0fa32

SHA512
848880c378161ce750011a66a02869183e3c732d4ea8713636be60bade6c1a3d1eeeccb17b5f845be00bdeeaed041e8bffb3dc4bf44911ed61de47b4a6b57c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
bc3b162ed45abead117ed631cae3f618

SHA1
d86decf0f586b9e68e924402de8cf8de9184cb0e

SHA256
50609f5e8ab2080bfea45c005c84e7c0e9c959ac50c323727532bd75bd5a1e2d

SHA512
b45c58fc676bfc11b5e67305dc1ff56bf54a161515436414a901686fe035ec474934037fe502ad46b506335fa05a6a56a108b6245f56d7f749ff516aba75e44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e5c53a84dd2508414b16e7f9b15ec153

SHA1
12aa07bae6094d768790f45c476fa8e070275604

SHA256
71070a3123b7d7b0b80978e9ed3c858a577ed89bdb2e865b97cfb18417ba34f3

SHA512
ead8a3a142f1f1f846c11fb8a93e55fc28edc244821301a7c33d09459f7ebb984c6ceca4ef84848ecebf4bec9e4865d1248eb58055f2a0adad8ec3c7622a2e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5b71ab48149fb0635197f248839270b1

SHA1
5e1b1d732309d50a635cd3dbd06981b75f8f73c9

SHA256
4b734d4b8ee684a2218cdaf1fc27bed4d84e3e4b0a209a9097febd7d43743ef7

SHA512
d93caf19f98b5033e7086987b70a83142258044075644e4f2ca3b77fb74ac549b0d31f4bf45e2db32730611a06d844156409e301a642475ee8cc0cea015740e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ff0d89aa01401d333915f8f1af60526

SHA1
012960fded2c77f616292b2d8f790bab0f1f3b6d

SHA256
d6ebeaf10d11c694461cd8229c69c0556567f73c6329b5811220e3fda5408082

SHA512
d5cdba42135d48c4174fbe5f4e4a8e9c541399600c9181881f8089e5319c3b27a74d60d6f3445f6ab9f3fea86c9ec9fd95ff5d36edbf6a1d482eadfa95ad8168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8b9b910d72ebf76c99dcceb5af5a189

SHA1
44bd15fdd708aece888efaaf6b6fcd3b043ccd7a

SHA256
b252c289fea1f3d443489870cb853d3c945b15a97100367cc4a48d2afebe5ab3

SHA512
269875e30a4041c80b901b3b253d2df6ba9a892bd2080de966f70a9b6d412b4d3639f487846a026e971413472b6821f262fa6b65415c3c24bb3f1bffd0ca3083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
289eac1f0d86a41be8204bfbb0387ca7

SHA1
5d7ee5f52480900338fd278350d225207dbea285

SHA256
ccce0565c5d5daf589630ebf5570f5651a7dd6d9cccddbb8f2a3fb12f370b52a

SHA512
9a633fa869c3b24e583f529e455f7154d8050baf6cd8dd4d1f214b71a7f4c5bf2a8df09ee7bfc1b0cad76bb3d1957e5d5bde9a2ea0088cf526c95614debc3982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
012bcae01b517d85f7e85ffe7e722384

SHA1
e2698a9b9e1d5d30af2b370a9743a7963c8c5f93

SHA256
39f8838b6ea6133c48c96392409fe4743eedcfa072f7bd6e84c907afee1aa02a

SHA512
8ab3aba861c45851066799f9286fba51f13784850dd3e378232dea78620aab07ef5e96a4fee3f0fe74c002d68f541ca9f1ce8869b22aa618b4644ec879a5ec51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3db82638fbc55236322fb74904cc840b

SHA1
6d7caf8c21fa652db6ece308b90bf052c97a6108

SHA256
9b6fad3801e1f72135ad826810ff23affcaa0321970abb13275f2ec4706581b2

SHA512
e3aba117ad0c956212d3f80d5650ff78990fc3d541fcdfe29ab5a9e7b0c576a3f4cb73c89da3afb2828c439851f570f99d9bdb74b642fb52b7bd5edf70477fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58198e.TMP

Filesize
203B

MD5
2c11e3e95eff0724ecd92e8d7243f73e

SHA1
90cee9390c991dffb49c7640b7fa3bb7e1a44c81

SHA256
8c43a864fa7e442d7d72c1d22851752e5d92200680cf8e2c1a1172ef8f3e276c

SHA512
c23448e46ccae9ae0ad40a396a90d4923e36de62b155904bdd19634168fb98c38ba7e529d8cf79c0043db179e69ab390a90ec13ccc196191e172736cb9bd5ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98a156c29aeae2b552a1818816ce6af1

SHA1
ce3d2c155d7bbb184f43bbed61deb91ac583bf2a

SHA256
b6acf1f98052fdd7cb24c146d06be8f5c23a9e622edb1092240a6f2d288b349e

SHA512
7ad3962c29e96b50badcfee449a2639148d706d1ddf984e07db80d22ccba3b3cc16c6f3deee08123805d58e97a601fe4ecec93e806125258e48726ade8ce3503

Download Submit