ecf77947560d36a545371a3d47ffb966358daa492c25ce868a632881018c808c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef9a2c533ddca2f1fa16158fdba60930_JaffaCakes118.html
Size

28KB
MD5

ef9a2c533ddca2f1fa16158fdba60930
SHA1

0c372eecfe6694d9da90bd0e103186500728468e
SHA256

ecf77947560d36a545371a3d47ffb966358daa492c25ce868a632881018c808c
SHA512

42f43f265ba3d2be054ee2e75b0d17873982ac80f880cd29730e5a20de9e36fef5b6760ce064a6a8e94bebbc374f40d2da62b19af78e2da2fefe6f267d07feae
SSDEEP

768:KJG5J6bgE9BxpA8bVlgaWebUBriY0hBqiZXdn8b:AG5J6bgE9BxptbVWaWtixhBqiZXh8b

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
768	msedge.exe
768	msedge.exe
1452	identity_helper.exe
1452	identity_helper.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4424	768	msedge.exe	81
PID 768 wrote to memory of 4424	768	msedge.exe	81
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 1756	768	msedge.exe	82
PID 768 wrote to memory of 3908	768	msedge.exe	83
PID 768 wrote to memory of 3908	768	msedge.exe	83
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84
PID 768 wrote to memory of 4216	768	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ef9a2c533ddca2f1fa16158fdba60930_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffa0d7746f8,0x7ffa0d774708,0x7ffa0d774718
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2282443029616568254,13551159688352675072,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
5211a7784011cc9b8633c3f6872d0161

SHA1
5062b2b92899d982522698a4114de9983f6efdbe

SHA256
559bf982f22f28b68541b85f3f5a91f730eeaf61cd0a46d5a4154b87a0fdeabf

SHA512
e48e38aeb042aa74c1de3df2ba8f87fe72a9754635dde601aa1c0c95a8bbafa13016f22d26130e0875ac723053c982e37a50f41faf8447217fffa002446aabed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4403c9bf4bd374ec149609d7340bdcc0

SHA1
58b47150e647310d30d49a61b68e1be3171acd86

SHA256
8bebed0fc6692348f6a49b491032d2c9a92b2b95d0a83789eaaaf49abef8d0fd

SHA512
6fa300e70c2e60e7ab6f1ba0e34de4e9f0f4102383786d982d3185a6677ee9bb67661e57256678c0b257c5651a362f0f881becdb3496ab67b310a0761a7ee930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
62f9cca9371c72e17e1886ada3a49355

SHA1
4d84842d6e27f240a562f744b273769b346bb2cf

SHA256
4ee3a432bcba34d5380706fe6a9c6344b0961b0605d7395666791258b753530c

SHA512
a4585af79e9e9e4a3a66ab5ee8b8d0c5668522e6ad250d60a040450054ba5d212fc20bbd7a731de54d8576cb04e49c25180bed00bba51e1f7a92e34901e676aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f19a99b2d0396f031fba0e58fcfed36c

SHA1
b65942bb467077575a45c0082701583201647dba

SHA256
535dd52a23934db53cba00180d95472c297bca2593d2f6d4d2195fc032ad1102

SHA512
1e1afdd647b0bd6c92273feff7adc49c24302f4f64969c39a06493088e64aff96e2232af4cd754c7206fa9004bfa3808d36c7c558090f8c67cde3e25bc72becc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
069e1c76581d4ee7e58418b99c1fee92

SHA1
709dab549741491d4b34b2fa5eac6671234905d7

SHA256
7004240818c4d33a5f953d9449a1a3347fa8e6ed0e35f258a436ea664991b484

SHA512
d05b3cb69305cb287e3da6c7d62ba536885dc778ee698727598186605186a41f62ee72349361a420a4e80068a23bb3a47df6a8e17f8ecc707e37e5ae8b378792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d44b2610f95ffc2a0184e5f08d44a236

SHA1
780fc0fc8fcca76a31fc48f82cdf85bce8f1d662

SHA256
e5197e30ac6f6989f73fd08437d44e6e323039f3ce31f5fb8d521e8e44426e82

SHA512
073b0293a7c32efca1db0c1415ad7bc966b92773bc0099fd8d45f974a241a1b0f342669e79d9f3a2e0bace0003a877f038fdc19b7074ea096851a17d56621f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c502cf47680ecd43de80fde8ad42fa3

SHA1
789344fe35471bb9e37d33731f6eb47718c675c0

SHA256
6d5a4a7698cf366627b8d94ea6db4f8f4ce2403d65bc0b9fb83f0cc483120bc8

SHA512
3cc7b9f27af0c82b4e4a12963c7ef2f0a66f909cc34ea69020757e5a95a4d6b0609f6708aa7c831754f33805831e5c3da89e1bda0f038ae317236210149e42ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
b61922b5ebcaa71d0d7ff26593cfcd73

SHA1
83b6816cafd3170a2c15c39c2d99eb139695cb34

SHA256
79c15bcce7b705ec069f6113de943f48deb7df1fcdfb4c6c3b425534e9d098ce

SHA512
52ecbc30d77193dcb5142b06a8bc76d467adaa568282bdceb2672e1b41e125980a1d0d1a7349f350d5abdd33fbdfc3ee6855eb582059a78f4e51125e9d727fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5886cf.TMP

Filesize
370B

MD5
f64a2d5e1d13488b38a5ff5519459eb2

SHA1
18459f9d250b544e6c20a6ffb80fbb312716aae5

SHA256
46044138779b9a4fe9099d2d978f31a33b59fe9764e58b40a427e6588caa4229

SHA512
77b3f1898707c143371f9b4422adfa9476bf57e015868514d1616d7672dfdc53dcba23d7663b63df17627638db9caae8d662b42853c9740cf6d373759f663b18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5b6538122e7c8abc79024e01d2d07288

SHA1
19cf2749ff8cdc9b6fef9c6924d0abc3ab4d4753

SHA256
089d46d80f83f080669f11fc9f0dd4136c0f33313458ea392cc74c8ce78ce590

SHA512
7e67dee1be1d063c1069c3f8c0b6507f932bcacc5faed41068241d790ecd3e7a00d453427ea5b2f744b336feff25286e7a61113e426415f5970df908e354b075

Download Submit