343c68d9b85ab34ff87139af40cc1c73d739e2a451ef35be3d2e283c64cc82d4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

809de029fe37dbeb635cdcc4c37f35b6_JaffaCakes118.html
Size

270KB
MD5

809de029fe37dbeb635cdcc4c37f35b6
SHA1

05477073412293e8422f6aa2f354f50ed66cb566
SHA256

343c68d9b85ab34ff87139af40cc1c73d739e2a451ef35be3d2e283c64cc82d4
SHA512

7d9380dcb45758a7b5e1935bdf8fa79d8603fee1a344c89120392a3bde5c2ef66741da2fb17276f6b8cd2d56ac44721b5beb24b08dde36d63da2cfbe42b34e6c
SSDEEP

3072:HuzrxgV9RfBibI9DpLOs0rl+dPQzSxuYqE2fJ6MVkPuKbs:Huzro9vqI9DpLOs0rEdPAx1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
880	msedge.exe
880	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
2204	identity_helper.exe
2204	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1480	880	msedge.exe	84
PID 880 wrote to memory of 1480	880	msedge.exe	84
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 4956	880	msedge.exe	86
PID 880 wrote to memory of 4956	880	msedge.exe	86
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\809de029fe37dbeb635cdcc4c37f35b6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffb174446f8,0x7ffb17444708,0x7ffb17444718
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
01fa04dfd3acc0897812059d8b9a3678

SHA1
c24d5c1858981742b2d68208242e369432a173a3

SHA256
7e8cf1207744d5ba87dceef7627c384c5cd84ac36184708f0c76c9338295a590

SHA512
2d0d3ee7e1f6f503d62cf3a39b32e0319fbc5dfc00251cd4ca9c666e4c0b45109dace0742c5539c9216ae73395b02fa3bd6cc423bde11f0baa7dd4a8e511eada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
547b642f515c4b65d03ff807758c7891

SHA1
5a75fdff65dfe8f1691d96cdc1ec32fd35a8f034

SHA256
ad272ae4103997296dd0a06aa093e9ce0671ee29205aeb5209a312d5666ccb5f

SHA512
e87c36a35d5a013ff7924894c470d203e7dcd04db1b4086bc6394491cdd5b61c2f3a6b32a5152493c7149baf8dd2295abc8db2cf7dc7d44f4c26b8af528992a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b05146b0fcaeee4fccfe3c45ce1d2350

SHA1
77ed2d49eb8da3f72c5aac34829445fb85eb635b

SHA256
aea13d4d5bfcbf0534daebb48bd928dd3c4e79527904d9922d8754564e662f90

SHA512
c0ab13590fa1eef7598fd6da2893e7a6bef5434f8e976d68fe085d2398a6e21474d95c9ffb5fc695abd69981e9aed2ae671baed7c3e466ab24b13a865ed66490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
86689a65f47d1aab2117af30a8be6929

SHA1
f25e22569e78d4656e57ed44194aed8af0eb3a50

SHA256
c8057079e2e9a1c4039437fe074b49884f300ac98faf612ad0767824a8a68c4c

SHA512
a522f76dd3ad3c0a5521de7e07231bb470c00572398dc204e3bace2290dcba09404232ede83c3faeb0c40cf2c73ab910901bd18cf20a2460016c8f09831aab18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dbaec75d06b7ea446f96b43777d85c7f

SHA1
ee1b19ee9d7fbeba5554829abb5de87624f6d059

SHA256
5df25b5d5f950c6ec2460a13d3964f44d8ad0eda76da23d51150c511b314da70

SHA512
0c46c2782007781e9622e8d0014e2ae8aebd38b6a21af7f3a74d36cd692813f4578e4e9b9af3fee50d21be7cd91f438953504e119fab2831a9f8194fcbb494f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9af753bacd159c0a083b63eb6fb3433

SHA1
c17e1bd5f8c83526f795a607e4cf59fe84d4808f

SHA256
bef6ad135db48bd9d2da7f26182338ca3befc45a1101610ba7e3a2c70dbcf62c

SHA512
8654866ac7b74b340af635135cb47f5d7e07a6fde09378aff8f934ccc8b14110f686f6e286d00aabc0268552c14f44cad34539c8bf7d5b58b8c93fb758d7ddb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
0db2c9e558fd1e5834d2886bf5101ea6

SHA1
0d102d3538ba4ab5f63cb5d0544c4cd4567ab4dc

SHA256
3b7afe56bbaea0a94aa193709a017de01d0e28d5ddc0d0350d58dbe4acd271b0

SHA512
80e9810ff3c4a6d84a02419c8f706c76a2dfc95518387ba6763fa25c30628d8fa84af79072243857d8146c92884fc907e383bcdc339f6cf8c9ccfe77d462e853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e57e.TMP

Filesize
538B

MD5
1b814b1868d3c5fde42d053cb62655cb

SHA1
84521a947413015b75923def843323178c30a0a5

SHA256
04c2dccb747225f32e4e8e4d085c449c059aa451840bf4a499c0277feac4566c

SHA512
f7fbb81a627696e4f113ebcc554022433e43fc5c8905523ece4f53304f32940f7497448581cfa08fd67eeedeab1c893d02eea0e0358c4cf7411b5cbd9c733a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cbefad36cd9f9929828f0a8b0b095f3f

SHA1
870b0dc65aa0b6aa078c16d3ba39cea13bc9ebbd

SHA256
c1824c19c97bfadfb5ea79c6b68e1be4cd93eb2a7040d76e855987ca6e4379fd

SHA512
1a007cd8eb6260257ec20d2a527d0afd7e35ecc7bd616d0806b2d9c0c4107de2365642aa4be04f8812f65ee5da2f8b8308035f6862efebfe2fa843ee2cb9964d

Download Submit