9f6fbb25088fd2da31f7b6315468c5db0423f08a09026f8a1887277c5f4c883c

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ba1229b8fdebde5c00496b555e31cce_JaffaCakes118.html
Size

80KB
MD5

3ba1229b8fdebde5c00496b555e31cce
SHA1

6d5265467cc6adede371ee7bbecf3d2c74d85113
SHA256

9f6fbb25088fd2da31f7b6315468c5db0423f08a09026f8a1887277c5f4c883c
SHA512

24ca6e564c197e9b7830bffde8c51263b163053992521630d1efa9e561cf0564e9cf9b02b83d941364e47a8457b871f31070c5cac10f1a986721d9f994e0f920
SSDEEP

1536:XpA3St9LSpPWuq88R+e1g8Op9/ihETGdWgNIjLhY9gNL4canMt8KUxmUqNbrZSz6:Jt9kWuqnR+e39NIjLhY9gBanMt8xxmUA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
4368	msedge.exe
4368	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2620	4368	msedge.exe	82
PID 4368 wrote to memory of 2620	4368	msedge.exe	82
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 4284	4368	msedge.exe	83
PID 4368 wrote to memory of 1876	4368	msedge.exe	84
PID 4368 wrote to memory of 1876	4368	msedge.exe	84
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85
PID 4368 wrote to memory of 1184	4368	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ba1229b8fdebde5c00496b555e31cce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa805546f8,0x7ffa80554708,0x7ffa80554718
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1340 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,15642842403127833626,12060716001718108913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27908fae-336a-4482-b08b-ceb632b2e28e.tmp

Filesize
6KB

MD5
9b05b78aa29cd49f559f2f8f21753453

SHA1
d65b8f9a9b41dcb37332a21660bf60b14cdd3758

SHA256
a24eb686b44f8339f81de051af1e33d089e04bde0c53f7b89175fccd62b567b9

SHA512
7afb9c1a8416f7cfe263d97ef4c7a8f69f3141c32f0ff417de01598b408f80e6b36918a6be81171d939db9d713aa5b88641ac1cc8909fbdfea1ee19c80e8a380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40cd2527-44fe-49e8-afc0-054130e3a36e.tmp

Filesize
537B

MD5
00c8cbfd06324cc4a187eb97f464513d

SHA1
02a596629f8f529d5e67e020b88ee063bdb89069

SHA256
92342f33860f3c415ccbe55982b82b36379dbe5253abc97609135062721dcb10

SHA512
5465bb7591f5fc9153fbdc33af9945ce26bd6afa58aef41794838ad6c228e5bc367903d79c0c0050761bc7c56d1edf67b69921c035996979b68d0bb022a2d7ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4ecbefb77732fb3ddb640ccf4553238e

SHA1
56af95bcc92e762e97138bb502aae92663ae6eb5

SHA256
8a7d5fbef82d73aa603f660dd04666f328a5656097a73d23d3643297866fa645

SHA512
99cb3328f0b12bfc026a193370ccf7d70e96d5994e60143c94444fc8681f59f9471ab92327dfd3d0d0c04cb60925b75eff5ca7303c5ff713a94c553ead22e66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
49d1b677ae9a614500071c2b97f35a49

SHA1
c21c0a4b3db065fdea1519a773919be8def10298

SHA256
3c1fc3ae8ea2ceb754ea59d1c79c10ee3d924342ab99dbdb9cb80075e0feff10

SHA512
55ffbb7f3646c1d204e36e8b48924dcd94fe597d86c0edb70cd798b0f8a90ddf86b1bf977846b8ad204035fccd749db4422b8385b624726280cc3ce70942d10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
607622267bd022a44a0cadb7c2fd8a3b

SHA1
ab06222b802339a8661cb746c6bc9a531522f49d

SHA256
557a3acd38481383baa9f219720aca64008e6340610e92218098c79679855d19

SHA512
7e2007c08847d5d5730a6ec0b0ab8a5ffc15c02aefc5d964eacc3ce1517e789920357df1902d00fc46ff8de20456caab37ba37bdb2e95fd316394c2ebfbc4f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8949b82121f136e5e40a96c97eff7217

SHA1
120b91021301700a7cf11c50fb62654e013c463f

SHA256
abc1095ce080727d48611f833745f8f1b2f02444162a1854f0174687b738bf4c

SHA512
0137f11a6659586177d060a9df1b0549e7b21ffeb9a2f4e8eb82cbdb8f14fec0b734a497a3e81c0f28e954077a5bea78c7f7f9cb00433538c44f9924144bee48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
571db31d4935593696ac9a2525f13642

SHA1
fdebbd15ef152af38ef2de2471c664a0d647dd69

SHA256
dfa3efab4621db3751cd00ca7f7d8e1b8432d40c5ceb8d45b72590c1a0e5affe

SHA512
6c760418520370dc796fe61702280caef416f4547e9b2c5c26200562c4f6b80f381a1b4c612cbb52a64a3fcb1148daa4d2aecc755367d62230b5edfc2ecda869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1eb616142721910c67ff7709982487ea

SHA1
36d2900131ea3c33d29cc9ea058e9a7842e78b95

SHA256
8302e135c37f83e3c358204efbbf8ff79ff0ccad083d6f16fc6edcf14bf5affa

SHA512
b02e06cadd2b76f1f2a1b32e5efd219ca89fb70c1a6acced184ea702758c42910d5f16d1659c3752d13964744a31115877b0f2c298160efc96c6f87d4d6ba066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
d81261f6ecdb6bf8b255b84aa6aa6d04

SHA1
2bf72b6adde280f0b7f51293022f953a866da48c

SHA256
fc186bb65041f45c2aab4815a6f68d4e9c5ec490b5e64e36e1a296ad01f42708

SHA512
55bec0b9ae486103ee233909645c2ea3877b8ed53614b2f4291f384e5bcb1241627a71206a036a2eae035d5946ecd193a8ed520ec1f1a82c63da3c48ea559711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fc90.TMP

Filesize
203B

MD5
b4a8ed18b97a7f497e3892f62c959b9f

SHA1
f3548b037ea06b2fa3c3899ed465e01f29a847e8

SHA256
1521b634716ba1f630d60cb4359dfe326115b8b78ff88d4e2dee32696a87c8a5

SHA512
e31ae228040004a9c94c157765a988425bee49c9e0de2fa038d47d3f50892e75782415504d819898c57907806bc575184bacf64872a368b1035231d44e6b121b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a8daa99b1f766a0a9797d42fc71889c

SHA1
64576ee8837c27017b5e95f0f8e37d62ac6cace4

SHA256
f733d4bf852737c41e328172d6afc865e55aba9a844539db84694aa9a6229ab2

SHA512
6a9f3c1d8c4ff1d8bf74c96d2f223e8197b044f00ccb1a3f82e42d05ae3d11c8442353256079aa3dd1c80bfc7ce8fca76bdee26e0a126c9b85054ec2e5d441cc

Download Submit