3532d5320a1ff682385264d80a3ed6859814020b21ddb6697202b857aca0ca68

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbf16871343eeed70d349932c69f1379_JaffaCakes118.html
Size

213KB
MD5

bbf16871343eeed70d349932c69f1379
SHA1

690d0badf8bf377560811b19fd6960c18d226328
SHA256

3532d5320a1ff682385264d80a3ed6859814020b21ddb6697202b857aca0ca68
SHA512

122419ad5b12c95ade950a4f7d14ef2e67dbeba9dc2f6ab35b73239e468423ddbfee82a5d2e70e306789e04f9c0a7a00255c88be835808a8c3e686440a7da8fc
SSDEEP

3072:9BmiOq/oEM3uWe6vi9xyyrModahlsZXvV8XcbqiB2tMc+VpXpGPb:3wq/xM3wLhvk

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
440	msedge.exe
440	msedge.exe
2376	identity_helper.exe
2376	identity_helper.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 3208	440	msedge.exe	82
PID 440 wrote to memory of 3208	440	msedge.exe	82
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2896	440	msedge.exe	83
PID 440 wrote to memory of 2400	440	msedge.exe	84
PID 440 wrote to memory of 2400	440	msedge.exe	84
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85
PID 440 wrote to memory of 3528	440	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\bbf16871343eeed70d349932c69f1379_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffc0a8746f8,0x7ffc0a874708,0x7ffc0a874718
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5217283518821540546,17299536950962232222,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6464 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
3671f6f2403ab3bc639d8263ff4b8890

SHA1
cc00f91ef427ab0a1ed9bba1e0f1b35d81c75fe3

SHA256
379140e46f048e8daee9fed7694d174d67281768ca663b9fe55a279cb52d5aad

SHA512
6513bee0d080f1c1e88e868714f0b9208a9a97df24bcfc14c5bc3743d0fa3003d360cafb13b85c0856f81ca53fb46748812e3449f0919001a43036f3125c9d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
e2fd0722b9c3692e0f9c247205b24385

SHA1
36346f2ee7db524c007c763ec27d6ca87647824b

SHA256
edeea029e531aec42575a8d2aff9edd547268e200af5318dcb18e78f8f239b70

SHA512
0ed3d6a3f5d50f66c30cbad8be094b1cc84ff5ee98e2c7a37e2ba1aa6c5ae1e23fdbcbfa672bc9dc7b595b25fb3e36ff1a3fdf4447daffa995e12e385e4a0f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
028445f2e73fcdf22afa6c9e587c2909

SHA1
6626df7e19bb5a1021a35dd93bd0d5d43a0d5d91

SHA256
4e34daeea1362102e52fbe1926e8e2b15ea2a5874f4a2ec7872aad7059becf27

SHA512
70ca284fce7c25e2c8835de8df9685762ab88cf2569e8df63bd747a07fdba88c4f6b41b2deb7729e4139496c05ca3f80893d79f9b9269f6a32d9380ec65ec1c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
471b5cbae98f4df2794a1d61ec66018d

SHA1
ccb4329d1cb514f36b267c78a51c66784491d569

SHA256
3aa49b499436965d82f9ab48798777f7401f01985b9028a63128916264a76b5d

SHA512
d96964aa44592728646d4e98aa2fc65a32c38ceb2be200cb418e5c32e840892c0e8f672902c8d4de675cacf878d95d71e7d10450feb8746b1ed8da80eae0a463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c8bd08d07f6a887252cadcee27c57853

SHA1
368ec601a87cf16b14da120dbd7e7480452c1557

SHA256
49d6e6555288570ca728b7455f10e7914a99edb8f8b52dcb100fb31d1679d92b

SHA512
3879b7d1bc65d72b6ae2fa17a34aa389b196245212e2533fefca21ffc71c6111befa7fad149e6291f1a0f6b5e99b5285c789b5e1266bd39320c55b72771ba113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c43200799c879329891c3ec5515df69

SHA1
c5c14d0f0db9e36f40f3a4b89c099413d7bffc06

SHA256
d0bf41675e16349da4af289e9b58b694936d2f334f4ede9dbcd809d7b22a719a

SHA512
114fc3c560a5f451319393a8b758999fdc9253635b42874e4d73178eacdda9ce074ae14f11c3827ba1dd099f7269ab2699e338d658177c7b956164a3b04d0c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f47e5a9a3227818a441f09c1c2adc89

SHA1
b6e3ef6f5f31614e01244889dd1d6a1ff4961f9f

SHA256
3ab1671096311a69a88b7b9f46769ca20abc6843ef1c55bc67582578ed6ff504

SHA512
8a4002a53db87d35af1b054a25eda04a23b46610bc30760ed8edd09d2f6454795ade4ff6013f1b23ea8795753a98fd5805c0901af4332fea259a7c40d52f5e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
78e387a6a9766ad11fe6d0ac8a415716

SHA1
dc3ddba097381ed3f8c8633b8bf2ea6147e2f7e2

SHA256
69257b15be095b20a430df849860765f88f404f2f021c121f33b43df837db6a8

SHA512
7934d5d25c191e4c9a381daf32738f58ff95868ab8e72ed1d9e67901afc513b9e0251baa3cf1c58fcc4c5438120def40f642007ae6cbfc715db0d7b9e3f96c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
28c0f4470bba923508ae5d57ffa26c80

SHA1
8b9e179f848650690eb2b86344bd8381a1103c0f

SHA256
70dbb3404b0bbad5387b555fb245a43f81eb88529ca5676f7b4a2ed28a0b4bbb

SHA512
4105324e8154a73d3b146786fb197e42c40fa6a459a1c80aa5b0ff51518b190570b61b19092ef5fe50ca3aebab2afc460be1fc9f06cd9a828698cbdd60736cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58488d.TMP

Filesize
370B

MD5
5aa976ea92938bee222889202445f7d0

SHA1
6aea3d2f7a64db17e253d9ef6808b610d8d5b887

SHA256
7cf91815e344897101a0f82175d019a291b42434ea7626dde48cb124c0680506

SHA512
d825fb7976fb7c441830daa0d9e95924d12d42c2b904f9f387d7f287c21e650ed15791d784875a32992e976b1c2280955a4f0b9da0f9ce41ef17d97b1e92fa59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc784b832f85ff00d7139f767a416b90

SHA1
1398df4aa090dd3922f881e5ee017e253e0be653

SHA256
3b4a5d34f28a87e774b22c31411ba146e4ab3be01994cbb5975caa98bf773a6a

SHA512
8e9db33f0cf0922bb4a5cdc22269b587e4fec1320b6a1fac8da178d7c5759d4deb10e705b159ca875a683704aa7fe4c002f63bfe2ae4816f2c129c7678f8b5f0

Download Submit