be3fd82f4b2dd7b2350879347100bd18070b0f65341c35737fe7278721082ae3

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b1bf989268e91352a7c147b2dbc0963_JaffaCakes118.html
Size

67KB
MD5

5b1bf989268e91352a7c147b2dbc0963
SHA1

c40b9051c28c610d8570abebfb5b0154c13c95c0
SHA256

be3fd82f4b2dd7b2350879347100bd18070b0f65341c35737fe7278721082ae3
SHA512

9fb21c6a4ada0dcb0236d11bfaa9a23c3ca2437c1819c5ff94ac75ef4bc25245a59ca52f78062bcd3b68d734f7511d018751cbadcd6b18f8303530305193ec67
SSDEEP

1536:RISa6ZP2bm4c3kNlX3Ol2b+8Oww6M6FOjRlSO:R7a++K4YkNlX+lM+8Oww6EjRlSO

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
1880	msedge.exe
1880	msedge.exe
1212	identity_helper.exe
1212	identity_helper.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1912	1880	msedge.exe	84
PID 1880 wrote to memory of 1912	1880	msedge.exe	84
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3108	1880	msedge.exe	85
PID 1880 wrote to memory of 3852	1880	msedge.exe	86
PID 1880 wrote to memory of 3852	1880	msedge.exe	86
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87
PID 1880 wrote to memory of 3640	1880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5b1bf989268e91352a7c147b2dbc0963_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5fa846f8,0x7ffc5fa84708,0x7ffc5fa84718
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,12676512235210176186,10990372501308037187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c25fa46-9016-4633-880c-fff96b93ab7e.tmp

Filesize
2KB

MD5
d9e9e05a473321a6088e6220ab7b073b

SHA1
3bdf1c8695aa0ff4bfaac4f62d2ed72b2451309f

SHA256
ea40aaae259ab546265ccb6dc3dc4993742819a4b3c5c75f715e35ee79722091

SHA512
295a672591b59aa720dc0faae188dd5fa084884f8d00180c6c11d18c55e3b33cad5a7dc654bbbdfabb3a71054da87ae7e62970b2d3d830438357782bcf4a0015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
6bf065cc7668b3d1cb6deb4c761d9eb0

SHA1
81932d9d8841217762a95e67f921da85c181e7c3

SHA256
fb3441a165f095fc719bae9a0525fb70c8dea53aa64f958d4c3993461a3068ba

SHA512
c463c046b6cf92048288745212335587c5fbcfb66fa404acdc78a44874e20dc57858f55f845d27d6fb2df3d6387b89d676daca2c2a43700245e7caec20e63576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
88b76204ed9703a2c7b4e95ceb4f4663

SHA1
97bc8d5bf00e6cd305028f036651ce0a7029b4d7

SHA256
2acfeca8ab22086b982da4a7cfb8cb8822998ac5b41959f63fea8d3df019cd00

SHA512
d77193a6ab07c7e0d0d684286637e77dce3a68e01b4ea0dae79259a730dff34f07d21ee92f81c2b58f419e219809c16f8dea4815982e96ef8b5ed26135cc7a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
cef66f9f85cbdcceb2db6981e1643703

SHA1
84ab187d6a6e9ea0bf4afb93f01265bdd5679fd5

SHA256
2ba55eb715ad4e8e780164521348d2aace94c8be102b84398362106b9ded6ad9

SHA512
972c6844497890eeaf5ce3e6b71537bee0e04a54060d9e7ac2a2aa792138230657aca31972f63fb089bf0e09547decfbda97bc23e2b0443d844f2855c8760ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
494863a27fcea1b54ea04350a2bbc159

SHA1
b35966ab16af02efc6b6932ae6b93c5cec7f28d5

SHA256
e915d17d39fe142b9aa7abcead02b79378593ceaffd4ab60b3adb816af942752

SHA512
0d0974739129a16ad36912bcec32e1f2bb028d47cef691d3c9069c6475fe30e57ad45ef694b0e53e1100648ad08b0f811cd81c25a0fe213df962d8e89f8be063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
076a49e0e00aae21ef84a6548257650c

SHA1
933f9b5091345ab8a67f88eff6ee4195d765c9db

SHA256
6d9ebddd29e606c61025a1cf228e7a46c22ae4899d668e443ab2a72167ff3f0b

SHA512
69bae7e3ddeb2c9b53333cd6301ca7bba7df85f0c71236f8c67f2e545d3337504a29a6e5ea2da7118ca0862de6324fc680864b54f1259244a1edcb67fdf277d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f9092c35bb71c10d08a967c1d91f3160

SHA1
24b917f7699ac34f0094a24c9f5f29e5e24b8285

SHA256
d863163478dc9195b7715c49e2498b8e0ad508467aa17956bc6cc550f758e343

SHA512
e0cd5d4ada7d5766b2290bdfe672e95b7cd1af1a22b09486e4ac711ff94dea5bb2305be1231001d6052a5fc563bcaf27323692eb042bceed8051c065b3bcf4b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
627697cadba84eff6ae0f25ab20b1773

SHA1
ef8e4d263a63dc4291db47081bada655e6ec63b8

SHA256
e1601e6b67237921481c9681556bcbb02497a582cabd23905a202333e1d6ec1c

SHA512
20f2520d68e8bf7e25a1ed586b59390a1ea4842d680902386244c7cc52c6e1643ba32f3bd063f71798ed284fec552589f2749badaba8a8d088a61e24906705a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584dfc.TMP

Filesize
538B

MD5
3bd9fac42015eef3b03bf161bda9e14d

SHA1
2f603a30272cc091452d6fd6e2bd0ca6611690fd

SHA256
d4d3c7faa6669eb9217d962a453dc9023704c0764f7d70d6a3fe1982af4d4a15

SHA512
504f78b0aca6ebd473949d47c31e9378af181c381d0fc99b7e71571413bd0221db0cf1b48c72a0385fb7c399db61be8b27b5f5f5798d5b04b4310251d724c149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
78cbe69cd93f2c774d18eec243413d3f

SHA1
11b6f3cdc29778ceb3d2907782bc169a665d9b0d

SHA256
787b3ebb14c2a9dd36a98da690446c220ee5fd53d279033926f1208e60f624cd

SHA512
1e5933f073c19761c671fa5fd22745a4c5cd1452b58d20bd12b264b52d1bd10305978dec9cfb8b832000896bedd04e2dc7cbf7b1b1ea1a6d8e371eebb79ddc47

Download Submit