7bbec773982bb714376de8af34044cfaedb2aa51c9e895f8c0d4c286df500a07

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

368c477f3b4af17db9d95e90be795d0c_JaffaCakes118.html
Size

76KB
MD5

368c477f3b4af17db9d95e90be795d0c
SHA1

d874876e414a349e093324f6c534c4fa35a79eac
SHA256

7bbec773982bb714376de8af34044cfaedb2aa51c9e895f8c0d4c286df500a07
SHA512

2c3c7982ef6b9f73972ba073406b42dc58f99aa48872e77031635c74dc218ec18b9f92953afa8800b3417da84acc62feba2bfe7b756eb4f277f6db74b2543773
SSDEEP

1536:FuHvYoZiGCdin7FIMUy0qxM36Fbg5ILJC7jGv8tdBaOpKd:FuHA63CYn55Uy0qxM36Fbg5ILJC7j7Bg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
224	msedge.exe
224	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2064	224	msedge.exe	82
PID 224 wrote to memory of 2064	224	msedge.exe	82
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 1820	224	msedge.exe	83
PID 224 wrote to memory of 3652	224	msedge.exe	84
PID 224 wrote to memory of 3652	224	msedge.exe	84
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85
PID 224 wrote to memory of 5016	224	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\368c477f3b4af17db9d95e90be795d0c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6b046f8,0x7ffea6b04708,0x7ffea6b04718
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1612 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14307493392354023547,18339398320403057354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9f0db65d300d6660bdcb84c2d2a71eb1

SHA1
3112bc0c561fd3f9dffc4a747d375732b332fa51

SHA256
39b3b971744efbbaa7b01ae39b1140606cbcc211ba3f50f459557ebd5b35055b

SHA512
5b33f993276bdf46b6d53651cfbfaa3adfdb9dbc0ecf0a797eb0dd29618918112d1ef2866bacd6842887a190db68ac59aa6a0a2d729e28b9288ba526608d9cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
3e6fd57f2e73b799b81506144079e9de

SHA1
9118b6789678950e88af557a052db2dfa71599c3

SHA256
0fdecb0a814a0149244f01cf417f779c1065a9c8b5790efbe00ec6f4ffb3ed78

SHA512
aa87df2e000cce936518ba351d3f6c44b4c06ab6eeb7dc161aa503dc8f3ef29ee4fbb537014bc2a6eebe2623f0314bed85a18362ca5b2ec4d314a2e97ebedd33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e9dda56eb65c5fcc4a5e0e151f59d0b3

SHA1
ce7e4a1f4be629e9aa638b1761515d60fd8ae34a

SHA256
2a1aa07b551dac829f22b401f3da99bfe82ad77ad6b38af0bded57c579002617

SHA512
9ff28dce48e24d715eacc563abba1402c2c953348cf05318a0451ab1da271ca87bffb9d3e9bf58a477c15bb8dcbbead92aad444f23745013006530ff071dc340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d44697720ef3a1168bb539fe2f070e43

SHA1
644dbdb2d3000c85e73392d124051fed71478f44

SHA256
a8602c25a682d29e9a427a0bf87498b05d7512f739086295d4b8f18540632276

SHA512
98769f0309bc9c47c4f81d88526a7d149cb9a0c74507f11a49cf29f3fc874167d3863cfc3766a75647c71dd82b9fbdcfe3734cf99c9fb52490c989b0371ad6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9833bb66e209a885f9ebad05d5526b8b

SHA1
9b5b61fb96aacd8f54ddc9280e9a61ceb6a2570a

SHA256
498ebf79be22d107f5026916c3fb05aed4a1565a843aaf55baeceb993eb46358

SHA512
de3ca56d1f2f702d1c3ae375b717db2eeb2d32fc93c3bcb513aff7586245ac7574219bb28665b07fad42aa98110e2529c4807fa2d32eceabe50955e121ef604c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
6ded69ae678b552040eb881cf9003f3c

SHA1
5444ce6eca0de6f532064b4fb8b9edf9b5d9e557

SHA256
2b3a292b4a8801f4dde0937e9e42588ecc4a30647ea69098881e20c7a5366bb6

SHA512
8a2ead168c5a703680257b04026d56d1fdc199c396ec5a3aa42133bf90cb01b94a08746b591247483b19a4b10a598cd0ab0ed2a27262b384cf4db04e0efee7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595356.TMP

Filesize
201B

MD5
4abbd6cb0d1f38e5be03cde86d103b9b

SHA1
f2dc5b480510f903195957c23ba952308a3b1c3a

SHA256
2f36190e9cdfab6cef13da4173ec900cad7ec364f24ebcad650cc2bf84197652

SHA512
0ad74b02d9704828d84aaea86ebdad4a06459c1decbb464b60c429026bcf121be1c4d0fb5a134b2f92fdc90392c56a7020f11ebf5c609572af8730bf4afdaa75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64bc5d6d55b49854f3e738e1cd161dd8

SHA1
10709cb1882ea9e7603dae0dc39e133cb61403ce

SHA256
e25d46c3d5c4bebb02e4decbb68ee688071c55f88529d76e801cd2b5c0901fc4

SHA512
21af4e71ab2d60f41f39a3a2793124c4a258c146764d5d348105f32aef00f69ab63fade54599f36f10f59b5ba404bc694cc1aca2d583609efe4434f0d5cc404e

Download Submit