0d58fdb6b555675ce03409e8342def510fa5a9bbbe3ebfc9942be8df9b10aeac

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c78306aa524ba7f647315ba4a8fabd59_JaffaCakes118.html
Size

125KB
MD5

c78306aa524ba7f647315ba4a8fabd59
SHA1

2c67e4eb3838d14cba088f7e0f72ea5dccf3e437
SHA256

0d58fdb6b555675ce03409e8342def510fa5a9bbbe3ebfc9942be8df9b10aeac
SHA512

228ee77de6a9e84c1db23dbab3bab59b84bad145411ed238d7f870c804824eb37c679c177c539588796bdb235ed0f9cbe68873cb032069c658fbd3453eab3cb6
SSDEEP

3072:dUxCWDxYxQ2PDxYxC2T/Z1sfoExH+ESefhENE/jzCqezSU3sO:dUx1DxYxQ2PDxYxC2T/ZQg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
2920	msedge.exe
2920	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3960	1344	msedge.exe	83
PID 1344 wrote to memory of 3960	1344	msedge.exe	83
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 1868	1344	msedge.exe	84
PID 1344 wrote to memory of 2920	1344	msedge.exe	85
PID 1344 wrote to memory of 2920	1344	msedge.exe	85
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86
PID 1344 wrote to memory of 4952	1344	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\c78306aa524ba7f647315ba4a8fabd59_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffccb0146f8,0x7ffccb014708,0x7ffccb014718
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6435502201697467669,8776783736210697028,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d2d5b10-14dc-4f0d-93fd-272ce2253a71.tmp

Filesize
10KB

MD5
1843247c3ea34e54e765beef26a12a4e

SHA1
673703e014e832624dba696ca9ad06136629ae6c

SHA256
3a43b77661563410e339b1a2a252ec140ffa1d482790ea990167dbc21a55029a

SHA512
1d4e8b756ea64456bafc09b41c02774c675d9f9637499ebbc58c1ff6f51b7bad621059d5de5456a25d631aed05e960270bc3056e3e66b3d377626c4da5928472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
4134fc9f8381a68d9d23e6a3daedf1a5

SHA1
3d9479e21b819af4ccf67c4db3cb25845c1cb627

SHA256
94c3604decdda3c0957f0b835fe4cc4862a9b41f300b0e7102f92b152f33af22

SHA512
a284d8de896426cf0863565f5b0f0e3581ffafe516de50755fb27b0b095f200d57169cb36eb24d08affd332d815bfcacb1552607144f972ebe8f13a6c3c079eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aa7c2a39763eb75c363643d91eded0bb

SHA1
16940290029180dc747d025b55318f85035b8f13

SHA256
c86616f03686c00655a85826925143ab5c08d149e06083bfd48d52636deb6b57

SHA512
ddd0d65b608b048c977c85464af9937d8f54f0dded361a57a2890512998e5c483a272701564eb4df306f2e4b764106c4e0260f953e15199955f97e11b8f76642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1d529413d2fcd4c9cfb4eb1411f789d3

SHA1
c7117966ec1c9082787f7195c5ecead2fb73f793

SHA256
98a2dd2ef86284bb84347885e10118179c603e4be0f2908c73631ba5d676ca3d

SHA512
9eb5c4a4d5a36c0dacadcbd2126c19d81e9fe1ae47ec982d426b5b87195840b45a5dfb013fec370452a79b4c8c221ec9892301c56abcce128aad8976b7a7cf8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afc8946f4a85b90d99a853e48a180356

SHA1
929cec375c63df18ecdfcb28386498104f7ab229

SHA256
632ec4a2646291b19b25f5a4b1258c253aca02bedaaeb7384570df968aad3929

SHA512
d2458df24a76602a3c80f05c09f137a1b68a464d28f061dacdbf2247b486357c3de0a2fb3b9d1189f53a6a88740783e8f7de0438929bb1aab54e9609ef9f5cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4fabb5663bb79337f36d1d51e13f659d

SHA1
8441df41ff6b4a931fb4cba0e748cc26b459c38e

SHA256
8f3cfd9e05b276ae27f8dee65f4176fcfcd9476ddf6ca081b43d6b1448e59d29

SHA512
de9ea2c95afece4b11cf3fd6963eaad4dc6b82efb94ca4642576212554717452b816c57f596858c9e8331638333fdebc78ee55bc87a18d0470920ddc2eff4ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
bcd96b6613ae9bd46cdec3fdd7e991ba

SHA1
8b387d5262372fd26e68e4548b94d94e5cd1bd47

SHA256
fbaedf969ad1dab76764d53dab6d732ad22ba734dc64580fb9ac8e194da2ceaf

SHA512
a3b71cb4bdbc7243698d40465e9e1f6a17273795545836a328063920ffe1600694d94bcbf5b56ef0449a7d9cc135ace5c0560e3fc5f780dd011ab8684f0e3f82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588cba.TMP

Filesize
203B

MD5
5c417eecd860f981312ff2921739aaba

SHA1
ee4954571145c264ac1ce86d4e82b1adcd287515

SHA256
4d558a3e4a1d956534cdf91b9d623cc5f77dc6953d8ff6682ba74f69e7bc23ab

SHA512
46ec4b69b90a0c15d1fbc58c4d6cf608784289696c7225ae7f35f1492cf71bde9b5ecacb337d2df86a6ab091e87ccd8dddea9433c9a2a58bab3b3012d165366a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit