6b1a33aa58e07ee13ea302a4336e4c8de98c6b3211bca099be34c5e1e3ac8074

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

218ae693fc3e94710e0ab10e5f68b6ee_JaffaCakes118.html
Size

165KB
MD5

218ae693fc3e94710e0ab10e5f68b6ee
SHA1

2644d9d6be9444a8cbac93433f1b49b3e0238def
SHA256

6b1a33aa58e07ee13ea302a4336e4c8de98c6b3211bca099be34c5e1e3ac8074
SHA512

1e613ece0d6fc7a022caf44fda682c55eca2aa58e69ccf1fe3663a273e594ede328e84cc28902b08c60be9f3405e309f6f4b5a588861095741dde2c0d5a48e82
SSDEEP

3072:Pa65PWWwuzHeF5J+AyvvXf77dN9cMGwvMbPDvFDkvUZblIYZUwyMSlxmr:1uWJIL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
4372	identity_helper.exe
4372	identity_helper.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4516	404	msedge.exe	83
PID 404 wrote to memory of 4516	404	msedge.exe	83
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 4780	404	msedge.exe	84
PID 404 wrote to memory of 2556	404	msedge.exe	85
PID 404 wrote to memory of 2556	404	msedge.exe	85
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86
PID 404 wrote to memory of 4128	404	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\218ae693fc3e94710e0ab10e5f68b6ee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94f5f46f8,0x7ff94f5f4708,0x7ff94f5f4718
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13616406768775290145,13094100072460530343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
84f94665b3063ffa4db0a0775aec9c5f

SHA1
c4f5367ff9968fb3f06832cbe717885ea74718f4

SHA256
835166536d8b7ee8c3bd76df3cbf89d764187ab87f7c9a6206c48a3cc5219e52

SHA512
8440b3ee5fd5874d67a29f2dac415752be0eaa41fca99f6e2a0a31f9dd20f54d7e86068bab592364a033ec82ebcae828b48a65acdb8b803602b1b2f0f3c86302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
021f48cb6542107953c494cdaeaab8c5

SHA1
6fab988ec648e1d69203031dce473fca37ae6fa9

SHA256
c82692868d6912fc699529bb17c9e2da704b0008bcce2c5c25ead8a0b97eb82f

SHA512
8cd7ec2f6fe9ce1198bb7a2504fbc93c2e217a9e2028970c7c8f88f5e09a1968d9be51bbdfed9fa53262710bb24dfe57d35b2b8a6dc38c0e876d323aa23db8b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a20c7a1af3e72afa25b46f90b74dc885

SHA1
67bbbb21aeb8d979a55b17206443062b6e4d140b

SHA256
2e2cad6002d8e35bff61918fcaa623fef23a926a0aa4b48a3a7aceffb4d333c7

SHA512
7c0d951e15b802abe7c97d2249426b976ed9c5f0f91a953b02ee03983c97464c1b93d4638a5a54c24cebbe9304430e4812cc72059f41a7b4d647630a82567a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9208637eb32b6d2a02f6090d8b7a2255

SHA1
1143a7f66f5d8eb65e8e9acc3977fa400276125d

SHA256
3e7f1180ab0077be46cf2bf4157d3be96d3190476ab2f5cd4042c092afdc63e2

SHA512
76bbf0a0a8c3dca1be76ec5066480339736c3e4513795ae390ca2097bf43119e88f68a6231ffd11a37f6a91b5e0beb8c49f2a16bd18b12533e9bd4a05e72d2c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f074d3a6c7cd278fdad2acdc166742d4

SHA1
bfb3a2e93ce0a961e8422069c73f301e38b084a5

SHA256
401497ec6e884b2799af06fd10053672e7ce34c42cb654b1a5191a2a2953723f

SHA512
b66a48c2de1a0ea94cc6227f8741a187b154953b55064d835f03c5e2e8bb52cf2c3c6559fd0d33eac957fd327677eb731de654a07544d6ea68e072bdc9587829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4939b3d29d56270837484614403c846f

SHA1
14ca67e93df43ebb049902996b245c7811bba508

SHA256
3834b3380783abb248d10385b1a4c90073f1bccf862994e867c3a4071a4ede75

SHA512
f9ca65e8a4b4f76f813cedcade73993fe7b2bf684102f8891e57abc129bb4691baefa0742a13f2a23c49d2fa8204696f523fe7ed27fc2420d90dbf9c168aa566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1519bf84eb37d159181555acdbad1bfb

SHA1
6fe558c51093df233256e125a41b2e639b9f4c98

SHA256
33da672d8e63e7d9b2c9e6b5314eb47ef1f381942143a546622543791272a8ae

SHA512
bbbbb003041465be4bc171f5eb749956e5f30f6264e5ac13558d2df11a4020bd69deca5ad9175cf6e32910507fa3de3e1ea9fabc898ed2b40c0f11bad87f6359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
531B

MD5
72b7eba9ea01dca2851cf4b4c296c2c0

SHA1
dec5ab08ab9c29b8c5fdfcb031931058cc2faf21

SHA256
18fdeb178c64b6c3d179bee23e85c69afebf2d03c6f919aaf09122adda4bac82

SHA512
8182b238a951141b5792eb74874d9857cc54e8483d036c8b11aee8bb08406bffb34198c17307cc0272db5ef36a0b9eeab8d0bbb65f7c02cccc9584c387024c5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578d8a.TMP

Filesize
531B

MD5
b2a1eaa30eb3f455779621086317dc2b

SHA1
998684614cdb4b6493b0781ea0b211558ea1bcf8

SHA256
b9d95c3868445f9a49dbc83ebf6b270c41249257fc252c7e6d910bb33f261928

SHA512
148b84fccc25ee1d42b86227c49292745b1cb502bf5cee256b608186e84904bcb0201b7e4daf0776dc8fbbbb39a9b126c1241bb9ce1e703ef9a87e05b0eac2e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c36e8a35372159d7ebb06c95b046201b

SHA1
1c0318ec3d0a7f7228d9a297aa0cc1820d781a1a

SHA256
a8b68b7e1a1ffec7b39e2b128affcda4a913650f7b5ff2dc0aa7b65faf31fa94

SHA512
15c4598e347ecd23c4eb0f66d35a51ce62d0574ede49387cb44f9687ed4d7970c8ce581aad1faafa9b5056c9cdc127ef96301e74f9ba13d038f675ce52b04a65

Download Submit