7f08536aa42767736551aab0dce682137a2664e6e6c62c2103863c5498fa2f90

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31188b54af5653e63721afebfc5b787c_JaffaCakes118.html
Size

39KB
MD5

31188b54af5653e63721afebfc5b787c
SHA1

32e9457101c840036bc3de284ac120793b3f55b0
SHA256

7f08536aa42767736551aab0dce682137a2664e6e6c62c2103863c5498fa2f90
SHA512

bedddc5b0f7df8af6e6c9700a3ee3b8b2967d56ecaa744c9a24a35963e0bbcd92a155fc9f3ee1d91588a83142435bcd86a60e496a067ba9322a212f775189913
SSDEEP

768:i6MXjxGO1oaw5I8fQNGUHNnuC5J6N8+cjjBsmrynfrVvdifz5SnyjPD5DxG2LC:i6MXj0O1oaw5I8fQNGUtnuC5RjjBsmr0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
4888	msedge.exe
4888	msedge.exe
2632	identity_helper.exe
2632	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4592	4888	msedge.exe	82
PID 4888 wrote to memory of 4592	4888	msedge.exe	82
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 1612	4888	msedge.exe	83
PID 4888 wrote to memory of 3984	4888	msedge.exe	84
PID 4888 wrote to memory of 3984	4888	msedge.exe	84
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85
PID 4888 wrote to memory of 2112	4888	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\31188b54af5653e63721afebfc5b787c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15912463152153415101,10533630121579010079,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0518f260-1d51-4614-84be-d998ec640f82.tmp

Filesize
2KB

MD5
48776d4ef116ffb5c085f4db9f2c0e65

SHA1
6896e7c07a8790f9b4e7fcab38d4be3e4da28fed

SHA256
74647d09bfafadcbc8d2f501c175ddca6958479e97ebe541aae2bc4e8f79c9e0

SHA512
d7db98902f523ea913ad99a28d49197f3d503e40904e3a34d1cad9ba802208c0234cd6197051432edf58ff9a026278be9fc7dd20e5c783726afd221de90d23e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
9956f47aa2a41040da132539e6959862

SHA1
181d1e730a6e3cff5713461cf1f673dba8e961b7

SHA256
f459452a09ce974c385a3b62c9f25e21aa90d9fc9cce59ef0be36044722aea4f

SHA512
7fd726f0e8e61ccf4663b082ecf79a14f2f479746dcc5dfac8526108b438a264c56ebfe86005f353c4071e121a9f981c4657279e2e563f681a113be98cbdd508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
528B

MD5
9d263345bb6336718f73d306e28cf567

SHA1
c2f49a056dce4099e6f44cb5fb6b13cfe5a8f98c

SHA256
4457088c5d12772fb851fb1a51ff79316054c10f8bd08b56b7669976843432d5

SHA512
83967ad8e3a813f66f35f0f500af61edda77541de7b60c4cdd57173acc0904c1a6c1600ef8fdf6350dccc8f5a78a695f3f08d9b7862f5e097441a8ad9032fc55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90e67bbe77e75806e3231be79e3bf507

SHA1
bf7af2fcfbd1152eefb089694ce458f72700cf5e

SHA256
70999a73178f67c0c08e1058a9ba94cedf22dd7ef9e86adcea451b17d1bb0d8f

SHA512
79c60ee1f73b09bfcc4be1b26dd925d989127f6525f4ec58497e1915d287646ae55a6c6d0444a9360247438c0a19398aa7091ff440149af6d72230873d736c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5b205c3752ee85bf9066e20b8884ffa

SHA1
44f959202dd28365f58b750b95e876caec2f6760

SHA256
6c8d10252fef42b58cc91ddb5cd3ca48977e8844820f128dacd168d89c570766

SHA512
09abd7c587acfa76a5169f77490689472f448bf01bea0e522464824e921f1ce806e4375ce3c23cce6159d2a4b2794992759d61ea65616890abc36614cc39e18c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7bc8af7e84f25bec939f887adaf1ac17

SHA1
105627efcd0889be170911020d50b5752021ee31

SHA256
1f5348602bac659b37cdc2fbf02b85b211e81804a260a0c37807bc9ac2487c3b

SHA512
a0f7fc2f064ccde63795b84b45170f966916b6ee09fa591a6e915531ee4b088b07f7af07d42eb137b69bcf7e5399d65c1d230bf531aa64d14bb099c3c3c2d38f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
06cfbe49231410dbc158b03f9e006b33

SHA1
9d2fc8953c2f00b3ee5a8b3d795312f43f6f7d07

SHA256
4b33150c2ab48710616f9e7566f347f0ec4b95cb2fa3763980571621af713839

SHA512
2be4fec97b9f5003bbb534b800608d8d7305ab6a9197493f8dd3ab877f9327354eba290615f16e6cfb3d0b633360a9beca07f45bd8e16febe49c056667a26023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
6054b6e6198112070b5b851297be535c

SHA1
e7bbe34595063598d31bd0e24abf6bd65bed1c1c

SHA256
7a9a446a8cb49109bb5df31a70d41df040ebfb241114268e22cb2d8770354d88

SHA512
197865a947c45fd7689646157f40e133f2a64564057a13d0318373c8c2ee453c92555c68964f3ba9c6de3212f6d59030a121472678e275f3c91110ff04de7605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582575.TMP

Filesize
204B

MD5
050a90f7933263cbf2c8ab919635415f

SHA1
18ae125963434d8c230b1ba44cdfd8262d45028a

SHA256
7e27742a671dc3074f65a7537037ac4ed6161479a572c07cbb3808c0a9c20e96

SHA512
e572c6cc433fa6fd90b153aa0a326607fa159eb47efc7569904246b40b1f5aefb5eee2c29e40de28560e4aac7e4e47f3a2d8c42b09b4ca0c49fe109b39c2e6a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90b8726d14f99bb11865b0a0bb20bc30

SHA1
408e6434e59b076b39a6603a92119d67df5564c5

SHA256
eddce081437406e6eba83095f2a25100596ae0f08cd4e0eec7fb478d6a6162e6

SHA512
b5a9fd0f169bb2ec5b975517ac8ff90f64dd65ec9238d352a069c2aeff4e78deb89bb331e50d3d399d350c8267934ff0e85e50c5af9a53d5343d1d1a8350bd3d

Download Submit