0c6c3ba5447c3612ef89b772d6e785ee763dc8f8d07eb913727d642989139784

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

859e5d096ed8b6a6ff3154f158a3af6e_JaffaCakes118.html
Size

394KB
MD5

859e5d096ed8b6a6ff3154f158a3af6e
SHA1

05a4696c4cfd287af13fbffa3b815b2167c7b801
SHA256

0c6c3ba5447c3612ef89b772d6e785ee763dc8f8d07eb913727d642989139784
SHA512

0c6b9878ff6b7ab7777d5e107082a368fb8e9311cbae54dd6aaba368b2af2d71c70aa8d7bd469d6b56f61a686b3337b29e71b3e1153222eb1f29a0d23115c144
SSDEEP

3072:OsW6WCiqYxDNvG8rmgcXmNRSz7bLer71BMn3/YBmGbeJPeabLLyeDNdTFzNzjd8Q:2DAXmNR4adEW8XyeDNdTFzgm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
2428	msedge.exe
2428	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
3448	identity_helper.exe
3448	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3116	2428	msedge.exe	84
PID 2428 wrote to memory of 3116	2428	msedge.exe	84
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 996	2428	msedge.exe	85
PID 2428 wrote to memory of 1044	2428	msedge.exe	86
PID 2428 wrote to memory of 1044	2428	msedge.exe	86
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87
PID 2428 wrote to memory of 3004	2428	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\859e5d096ed8b6a6ff3154f158a3af6e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc41a46f8,0x7ffdc41a4708,0x7ffdc41a4718
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16289953681633501653,3937727247652788189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
318ffbb8b70b421abc02996dcfe8afc3

SHA1
4240e64a8604fa36481bf24471545a2c7c10c89c

SHA256
fba866aea3cb0fce98cf10cb57975933d6cfaaed27f9f25250008814c9bf8e95

SHA512
1a0f6266836348c4ee0fbfdfdc9197b66add2a5b150ea8a1205b4e3876eb5c82d7404bd26791de29ff48004dfed187d9bab5a9678dfe1c71cf513dd49abacc56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
4c0b5730e6380277a6c08d94c3e75343

SHA1
aba5eb7325eb1aea3d015d292a232e9890f1859e

SHA256
dceec43571603d40418acaa5943ea33c6e7cd342404ca0d057d07dc94ffdb58a

SHA512
a2064fa942a8f36f19a8139670106ef97cdd353bb3fa13029b08bb9ccabe6bb1602fb2b0278966f89a13badcd79d8f882e054dda436c77969904dfeb299b6840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
527633afc9b93e1038042cdbe630a109

SHA1
d22cc63d0da02efc003992360c1ea9760988b9db

SHA256
d43d166346e2dddde364eac4ec640558601d5e7243bf89940e070929c7eb4782

SHA512
4891d7e53dac2bbfabb5642fa6a67d7a2b49e1eb891d4b60dd1aa218e5607d4fc00c443679fa325c4d06a2d8b87667eeec0b5c096cd49206f51c51ad87a414dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5ad2729ea6265c12af125fd33da7070e

SHA1
61b72b9a6c587edd82277ba1adf2d60252d6c4e7

SHA256
040bb10b3688d63de5619188f68ba50b6688e804122d86e209eae763aa4af5df

SHA512
18f8d283a45428969685e505cf3f060913aaae1b0dac90e07392264f49a3f4f9cdcf895484ca1b7c5375016865883979615aa5b1468e0da042113b483375a33a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
58d6c2bcb55c54fa76a6d365b982d69d

SHA1
afd900a1b3b50798a1d0c938d3cb90ce55c82b6d

SHA256
02f83f89ce9f84fa749cf2e989b8c7117824a483e29bd5b3e85029e3855d162b

SHA512
90b19466629bd9e399ddc27ba09f9a53886e8673d7f6a9f48cdb5acabc3bc78465918647cd7faa8f598f5e71b7343ae1f6ff7a67ebcc31fca3c5c86770fed461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72c70550ecef7776837f8536b1162306

SHA1
02f09e5756ac93c369786df43ebcac71f532ae21

SHA256
d426e8603ce0489e66eb0d6eba356085e003685c6d89a7ab28a56ca25984dc81

SHA512
d3410b113f80982788da6947be1337729e9039096cdabf1e4136e7c19f0070940521d173451205943948bed44b3234a41531ee91c9dcb6bb91a0495d94dd8a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fabc491924868444b7f84c9ad8ab06c

SHA1
f30d494f7deb5a3ac6fe85303f70088023987192

SHA256
2fd6584cc4e661bdde70a4b20bb033b33d206dd23431c660de91c6ab41f44c3f

SHA512
90353b9097a893809c6bd486563f0350a6cfea92cdb660476b5c9454a3ec98d4a742083e7b84becafcb1a6d38a29477cfddde4e748a550cba31b14a637846a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
699B

MD5
f4946dc0e6d78b086656e2e415e9ca08

SHA1
65a73e0ee944e7f78c0e5f44084580efc241018a

SHA256
77ba6bd77e8a90fe8140a592284e0234556f8b411d4b085965e617fd191a55a8

SHA512
c6db71bb5d3502f9656e39cd7600149fcebba97944c2228ca4178bd376384b6a25f6d60382594d95ee7c02d671c9a428572aa8ae7b9e6ddf5302a84381040919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
888239640e0fd28fe4c1bc30b9e5ece1

SHA1
fa2bcb1b08d72963695b675a3ee22545b1f86f61

SHA256
7f53b43d43a436f834176120d299546ef9853a544c539d72040d6ab2412242e3

SHA512
375462cb5157b3845a931898ae698fb1d7aa93b13adc6b4233a30e25c250a56959556a5dbed80fa7436468849df73817ebd9d6b372ecf40203d88789d89ab66d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
a1655a60a586104d8e8b31002e425fac

SHA1
343a3eb47ae0669862a8072c5915936530ddceaa

SHA256
871ed80cb79af5f12622429f30b0d34cea05252b10d895592abb06ec12ba015b

SHA512
66f9b4deb4e9d5093be17d9f4b7e0dae713aeabe74b469424e82f86c1458b9c0c593f93b33c21cdddc61a29c0a0c2e3873d561249e313cbc1ae93c854c38543c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4b0.TMP

Filesize
203B

MD5
680c3638083ce749be1556f311fc6d58

SHA1
adbe79fbc25ceaed689c4a363bf4e7f8569b0278

SHA256
daf5fc0e82b674bbb80cf6c719ad85a023438b2921b7a05ca7c6a1a59cdfcc33

SHA512
faa051b23c2fdc201b64b7a0b2aab17d0dc9f76717e3408076effc667ac5bbf0fe1053c97e1c8b212e4f496be00f8e73bff466025b06bc9a24f70d91c6d8e4bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f681d34238af312b7181f6f7357fb780

SHA1
def16a992522265775b9c97bab280c6f2f8a5413

SHA256
0b7fe3aec83a38f8848ff3d1b385a2c6e378a8cec581477900e6bc201504423d

SHA512
081921a4905c4273cb9f08ac8aebd03ff178aad97fef76266dc0f97950a9a3ab087cfd6fe7c97caf148282a1b5047281b08d3c8fe92d54bc2e33584751560f6f

Download Submit