7b646e1477e6101713484e009d5272d86ae9682298c1dac8e0782a2d83de41cc

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29c2f0b07d10606284a87800d2ba6de6_JaffaCakes118.html
Size

50KB
MD5

29c2f0b07d10606284a87800d2ba6de6
SHA1

7aab092d7275498167c47797787d9f08598dfb90
SHA256

7b646e1477e6101713484e009d5272d86ae9682298c1dac8e0782a2d83de41cc
SHA512

56076064c6f417e0c21b2312ef9e65f813b4291650b9fa369a5c0a2785c174bbd35f74f432d22ed686823cd6529754e9cfefdeee6c700fcddd9bf0c1367dee69
SSDEEP

768:7XRcLdGf0BeJ/EE/EZU3avZZf/imRIzmk3xuH83lPcpuTmxrbuDi:iLYsBeJ/EE/ESu/il3xuHilPcpuqrbuW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4108	msedge.exe
4108	msedge.exe
1284	identity_helper.exe
1284	identity_helper.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 2160	4108	msedge.exe	83
PID 4108 wrote to memory of 2160	4108	msedge.exe	83
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 3496	4108	msedge.exe	84
PID 4108 wrote to memory of 4968	4108	msedge.exe	85
PID 4108 wrote to memory of 4968	4108	msedge.exe	85
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86
PID 4108 wrote to memory of 2096	4108	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\29c2f0b07d10606284a87800d2ba6de6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3e7f46f8,0x7ffd3e7f4708,0x7ffd3e7f4718
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,10630198736194407684,6539664318131020706,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d2290e780e5b2dab23b53f9a487f5824

SHA1
e7b745028c614339a0798ed61965b3bf053d3d29

SHA256
10ceb133ebc1487795f36eef6ea68bebe9436b81a8f19c321ba540392cc4f019

SHA512
06d63d988fd2e0d3e94b691ab4ff8b712b9affa8a9c828562bb4b2bd6638eaf9fb588bc4f57c1b3b52709be39450a3bfcbd3200967b42da306430d0a181dddae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f964ba6f7d7502f098131565a8e8f965

SHA1
46882b4fa2cdc1fb64ade346f6771b667801887c

SHA256
b779a07b411d6e749d21f1d9f2bca4de2ccccf96385f9653e2f1554145c0636b

SHA512
3d97ba5ac392a3e7c8f4c3e45aca0a018430b735d61d8f35d9f62e0a3c36f83bb60bde715299aa5aec0afa616e6f41962dd02790b830192dedc751abbfb044a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
baa323be56ba3944aaba673b28ae8e2d

SHA1
b65ea2e7c96359b28110a514b1ea0a327c98d4a1

SHA256
08ffbae468067d4bf11ed7659b5916ddcc2b6c2830c841e12e20b9274a7bda55

SHA512
807aee3e75ece5c13100d151ec2d632b5b3e85fd50deaffa13b496a61f6fc55d9ee51059d1d189fb81bf9c5ab10ed4dac5295e93a38a96057da6c48d9ca9dd7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdafd3db93f8cd6ab36f1f6604a1b88b

SHA1
071d53a9f37068e62ce114a88d20c03cf57660cd

SHA256
674cf45d6eabf88f154cb0adaa6666dc24b0f98ef5293d669bc292cf19b96d05

SHA512
4865f9b85704e8444453d97e5d95b88f0fdde481799c564df1e2315296dfdaaa10f5f326041bab56371eb70c1ff0bb417193388e87b314aedad917d78c5c92bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ecd210d5de7d48000333684bee78a263

SHA1
c2e7cd98eb957f0c0cd70982c96001620c476ffd

SHA256
2d35a0eb5a68cae5e1c1754c9cf7e997f81de2b0ce1f3b7c4e1f11bbff2e4a55

SHA512
0ed081e100821f262af23aeac5a0481b267d6581db37e6138801d7b9fe6d9886c3fc353869caa43fa90a707dd1cc6e5335837df1c0c82f8bb7eaa13d99183293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
ccb0f93c6ab8038ad5e640ac61e8b305

SHA1
851a24f1d4be5be95027618770320cf26ff343dd

SHA256
58fad9c02f3ef1f37c3b1a3a87539f45b5d573e9f84ff4feec648d42adb6bf39

SHA512
0ed060c304d31477879d7dd2b5e7ef5c574f5c9ffab3d4f25532c24b3d3d7b85c656a7470870790a4b3cd30a1d3368372cd53a5c474af6fdb8145e2a715dced4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801a1.TMP

Filesize
706B

MD5
c9e21a9855964511fdf0bdb7924bd0ec

SHA1
77254a69a0759062cf4b6eaff65f287ee21524f3

SHA256
6d8b52cbca57bbb19e25271a6a0bf38ee918d1920925f4c771da858ffdbbac0e

SHA512
8da21d66ac1e2441e0d1be619d8c8e39e9186ce0297500bdd3dc732cc6a933f6f90738cc2c68571fbb46ea61b47f21af28c306ac77612d3f59486fc4d190505c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cf70d3f197e0b333c440db75d36e86c0

SHA1
ccd1cf7f0f992b6b65c259553cd0b20c49f6e474

SHA256
0a9fb09c0c06937b6e0fae5f42a63a191f426dd255b046d252ffe289b705c560

SHA512
513197a7b5641eda0a300a8aae391fc983323fa0b76d15a2a6d6e095be954ed926c37fb4793a54a60cc9c9cf4697b6e79885123d271c9b4c64624d1d4407dd73

Download Submit