92c29e23ee07a43e905ba056b1e19bb44037841599452c2586aaab21189a2dfb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf33e4c3a3528cd3468108d5677ad891_JaffaCakes118.html
Size

124KB
MD5

bf33e4c3a3528cd3468108d5677ad891
SHA1

014b03f0a3ef96c041c2c1ec35c58a8c1f077067
SHA256

92c29e23ee07a43e905ba056b1e19bb44037841599452c2586aaab21189a2dfb
SHA512

21e7d68104fc5be2943e938269374f4ee1d1206968c8f8635bd2c27876890edb732995f45b9bf7f9a0f352a29df9afb35bd0ac299d089194b499d83a15a9f9dc
SSDEEP

3072:EkclXnWSG+5UMyFmKqIHkU0iT7hpfc2Wl0gqTvevIstMtxUs/:EkclN9aqIHfcKKo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
2420	msedge.exe
2420	msedge.exe
2080	identity_helper.exe
2080	identity_helper.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 416	2420	msedge.exe	83
PID 2420 wrote to memory of 416	2420	msedge.exe	83
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 4928	2420	msedge.exe	84
PID 2420 wrote to memory of 3396	2420	msedge.exe	85
PID 2420 wrote to memory of 3396	2420	msedge.exe	85
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86
PID 2420 wrote to memory of 1040	2420	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\bf33e4c3a3528cd3468108d5677ad891_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8568146f8,0x7ff856814708,0x7ff856814718
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,16793938097445991230,13893264573325507779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
48eddd2828b5cda366caec0241019ca8

SHA1
49fc1e4b7ae0d77032bd6e2ca56fb946170886d6

SHA256
eb6cb6eb76cea5502aa7aade0ec752111b1b3bd6c1411230f3de348dd337ba70

SHA512
42116b94e1720a9a27a7dbd7d4fa755583ed10c329755ce7acf71ace383d81364db5f62e837cfe64a2eacd5a051357cbb4c997b5dec3ea026f5cbf3412128fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
4b0f1520d3fa6262bc85d12206f4b2d7

SHA1
7ea1261743327ab2054105eaa021368d36d2b54c

SHA256
1ab081334157f8bfc2d20f710f0ee8d6142ef22469a6ceaf7a1e71ce3660465e

SHA512
78e28b7d94ee61c1d6ecedfa9aedf1ec52f6b07a20b954383e8409ce298ebfe214ab49977ffe5c022121f07ddd47ffd4c455315d8be87e00ec86adf730aa1c82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
959cd38529792f9ee80ca19273f22949

SHA1
6dafc4f525f8cd8f41adec73e7985e268c185316

SHA256
eefc1bab4fa08af1a7da717418f1d6a3b8a723eda6e188b88d45d6f73c821801

SHA512
5b1c6d8ed52a2c4254ba52e6f18804753c584c18f7bd970a4641020b2b024ac8a2a0a03d4306392e5215a3f8e9a7c01fa3455baa8ccb054cd985c3f1f89d405b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
724cd073fc7ffabb0807db88cdaa58a2

SHA1
f0032b96ecddc23b5c5f6a144cb62c1bd4666fff

SHA256
ae90b50b8c700ecfa9bb90d5e2e4b3544d2ad353965445e0e8b171058d9423d1

SHA512
f6c1c0806d0afb150122e25f07fb4e10487675a492dd4c10046554058584cb6c8fde7639f97423f592f60b07d350211d0cce49d0af8dcfa3ad38708ee3c677de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1b179849d1ddb60afb4877a2bb80c3c8

SHA1
d30a9a49612cb324359e051c2f5b2a50c2843fe0

SHA256
6ed1243c228155e5736093bf121d7dcddc343205d2f59e53c86c141b4fdab760

SHA512
63df98c54f47442c3cdd9f2f4b2fd9d3fbe5a35e839be70bc162ece96bad865039d1aee6112fef7dc90881cc50d18860e6ae9639aaa64e8899031a1c394b00b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7e5c71ba993c61e219e868020f2ac178

SHA1
6cf0f02dda27c09cfbe63246afeb5a15a6cf4b93

SHA256
22320d6d653ebf63ed56d911f3412339b29723b7f3e161ae23a7b7635cd377ac

SHA512
c664b0700d7366a014407472389b5fd6a6d2e595f7064219d6b17316084a8dc73a32b4fe3efcb0526eedfc694d3bbdda22e831bb612be5c1eaa995fa1fd26fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8fdc1459be50108366511dbdbf6f7060

SHA1
51297e0988c2cff20d6e782909cbbfa49682de3f

SHA256
7e4a01f236feabedc0885af8d45585cc2486bf128fe214c374c47e45f9dae255

SHA512
3dd5dec63d1ab5a9e973c18e87b7e7e6c6d29d4f6977f0f3606730eda9ce27763689e2099712ec5fb7470abdba8269ec46192a5c9fe4e5d165e4059301c2af21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
d013782243f5d02df50eec7eafef68b3

SHA1
b380f0fb63e476696ba382eec2cab46fdd2b067b

SHA256
21cd2996e94a9c08bbe652f3408323e53fce76c812da85f3c94f6d6350957d56

SHA512
8300133abfe82a5e3697ac5b225258274b65a833c50b13357b871a9910a0f28f69c8909deff74f0bad53308fa0237c8d7096f9f5eeed85f92eb8e28d45b1a753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5846d8.TMP

Filesize
204B

MD5
aaf6289663ff4a1b328022b134cc0355

SHA1
4acc929a4eabc07474d3d9849795886bf4b38d16

SHA256
e52e3c4ee45f3569a9c92d6f785b1b428bbe6328b86f03383ca84844b089c6c6

SHA512
e4f7d8fbfe71b62b7f1a7500c5f847736971ba3cfb5ebad47469eb44b24162c11c74a7c3c81027a41ae50fd474ce8f1c2fe05d39ff24e650e3ed600830810bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9674d62e3b7bb6eb2f103beb76159f4

SHA1
39ebca40f26f8c2115a44824a14860e753df76d8

SHA256
521819dfe0149a17c7681b8c4626370f35209f64d1dba799a0bd3e7fee105697

SHA512
c2762c919c912bc6449d7c13e5a1426db6bc48b1b910510493633028e1e3a6a80c0c5efad84fd59bc246d16ce677f305d3b530e036675094c1c2f4d196b0eeaf

Download Submit