b818e85f1a761ed80186082c2c6162fac96df90d5bb1f4f798fcb7ee7867e884

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80716cf3a9ea1d87b6245495cf761f43_JaffaCakes118.html
Size

132KB
MD5

80716cf3a9ea1d87b6245495cf761f43
SHA1

5e16718ec30b46446bb79aa558ecc04699288ae9
SHA256

b818e85f1a761ed80186082c2c6162fac96df90d5bb1f4f798fcb7ee7867e884
SHA512

ef70357aa6ccaab345770ff83763d751ad2e54ab479c5555e3485dfa14f5003979da77bdf649c8cbc10db850d82ce8edd37f9a634985dc22ddd2d9fbf2a33b25
SSDEEP

1536:2uJEEJXFj2RUCjanDD9BVZfkjnJKlf5wrw+iT:2sJXx2RUCjanfVZfc2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
4004	msedge.exe
4004	msedge.exe
3668	identity_helper.exe
3668	identity_helper.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4296	4004	msedge.exe	84
PID 4004 wrote to memory of 4296	4004	msedge.exe	84
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 4604	4004	msedge.exe	85
PID 4004 wrote to memory of 3028	4004	msedge.exe	86
PID 4004 wrote to memory of 3028	4004	msedge.exe	86
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87
PID 4004 wrote to memory of 972	4004	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\80716cf3a9ea1d87b6245495cf761f43_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc13cc46f8,0x7ffc13cc4708,0x7ffc13cc4718
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,8501525026441955553,2640482166707930940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9451ad7ae61acd2893e30914cf2686bd

SHA1
8b0e6816272c7ddcb9769efb9b04139b87dc14cc

SHA256
cd6b11e81895092e6f07f6dc2310e422c28750c3cc3cae35569fd2cf580253d0

SHA512
d71c3e92df56b7f66880552ce14daa3c4afc9544fce7854faa38b1c874adec260703fd01607cc1ebe6e08190334a42d6de22f7452208e93416c4ec1b589bb915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
afe89289ae6626809900c8bcdfc5bd46

SHA1
553f9cc55c9de706b65292ea656b6bc55fe23203

SHA256
9170801a5df51dee6100bce90d8de684968159a970150082ad9593a474b13b69

SHA512
b6ac3e9f79ca581bd8f9c5f37bf182f5f3f2717adb7b585ac1bc67a28f339e945f29c99bb47a839a378c4580dcada930739dcf31454b4a59b80fb2903c0b933b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c8a60f2c82cb9249174b7d64e14c8ea8

SHA1
e99dc795279a48250dc2c3cb74b554db1a1ad1a1

SHA256
c9ce8de7941927a00063badbe1e321b8064bb38825da52aa75541ec9f30aefc6

SHA512
8cec757c39f4592840f1c85f9aa5b98c7ebd55a7286c5b96348fddba563b170eef73520c6984ba6d8ea8f9f2c89700584cb5e0129d293f25b29284a51d7b9778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
996e1fce4f72c372bbffaa60c42acc23

SHA1
5d8f432344fcdb3e2422e471b709dd3d76e7051f

SHA256
b670ebb1dc4cfe5a0707e12ec0967694d85fe5b4cc0a4b1e163a972945ef5a59

SHA512
34090a3386931dece620f316b3eb8aa620b57a5465bbacc791554273ce5225bd221de92be997dfce7129c4a3629b8e88b60c763e03d4cd7560102d37edfc9674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d644937e5c4e5789261074a2a66e66d

SHA1
3eca19f83b3e5f79bfb3e7a8614177665d4555d0

SHA256
5c388e4b854ee1ae1478bdaae908035830bdbc6033a3ad5c871cf54c80dfcbaa

SHA512
662deaae78a90aecb49da2594b63f09f5f48b01eb821751ca50959cb2b3e5e215f0b15ea3bbcc0b6997b901a2b4db7300945ebb17b7a9f5ca7f28769b9c85de2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c89c4485f2de5fbfa284d20a3e526c6

SHA1
db5c0900edb54d7e5758a37a712cf5a4a971b5f3

SHA256
551e31d387b43acda12b7c746ff003e348e0aa6b0ff46cbc240e20ddb5209cc6

SHA512
efcb7f1c83931a9260b39c836a7a23acf3b80f590f9cdff858ab827961cc6b769aaa6d354cd7ace04f9cdb0e0585e34a7fb063045fa546943be7df8826cfd113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584561.TMP

Filesize
874B

MD5
44a337dfcf465849fd2c0ead2eb036aa

SHA1
b442e1850b0eed87a280954219c77c0c414ffe5b

SHA256
ddff9342f3d35abb7fed3ad7a3d8e7c2da871264fd6fea32a373c78a333fe93c

SHA512
67942ae02320d8b7ecd564bce55d07434fc5f67432a496395d0091480b4295f6fe302a61f0cef27fed2a72427181536b11b650b2e0493e390d5e1797f0dffa64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca84fd78482b64e18d9f0aa451e75a96

SHA1
8ff3701105b4bd7e1b6a625450f2546d32740092

SHA256
2885b943d3146c9bf68e23ec7d23c0603c725444fb2d27ea7c8b686bb6d875a8

SHA512
b91e655376c3aa799d3e1835a78bb9ddf424813f8dd4b8512ae6c2baed04d8ec4f745217310f8b64cc09c7a85cb1eec2941d119d408333c831ed89990899c3d2

Download Submit