cf0cfffbd4910d8f2e243da84096853d3e4976eb4fe80aa1f43eea2607f5b6bc

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47182e574a9d5ea9bab26bd0f86f9d7f_JaffaCakes118.html
Size

83KB
MD5

47182e574a9d5ea9bab26bd0f86f9d7f
SHA1

5e7ce029f98550a5b73fe33aad5ca905873b2a8a
SHA256

cf0cfffbd4910d8f2e243da84096853d3e4976eb4fe80aa1f43eea2607f5b6bc
SHA512

470933811e185bff2fb0671b4cc1bc9610045843df03d4319cd85a34a5e7c740f4caaee8b6f65738c37805383828f022d6fba26d9429aee8ddbccb0034c8357a
SSDEEP

1536:fB4L4nIOyjfjeNJz5y9IBmDDZaMkvww26ruM0fiO6TWGaK3G+IWW+dfE3w3DDnN:fB0mIOyjOeD02EimIWf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{6FB44B1B-5A11-4183-BF2A-A9E33F74DF14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1912	msedge.exe
1912	msedge.exe
1988	msedge.exe
1988	msedge.exe
3488	identity_helper.exe
3488	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1960	1912	msedge.exe	83
PID 1912 wrote to memory of 1960	1912	msedge.exe	83
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 2604	1912	msedge.exe	84
PID 1912 wrote to memory of 1780	1912	msedge.exe	85
PID 1912 wrote to memory of 1780	1912	msedge.exe	85
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86
PID 1912 wrote to memory of 2004	1912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\47182e574a9d5ea9bab26bd0f86f9d7f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d0c46f8,0x7ffd9d0c4708,0x7ffd9d0c4718
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2121476737892568832,50529348569655189,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
620eb43e5514b57a8368dca2a57810fa

SHA1
6d96766df50b1fb13a2a0b8ca86a1cd499fe2ad6

SHA256
1917bc85f28c96dc26bd3298be354b489ba448310f3a414cc853a4dd5568f880

SHA512
7aeb1cb6630d260de01b97d19c891b3f0f9084a8566653edd6b4eff6d80a11689abd2bcbe272fcbc64ccc6fd364897103f64ce63a9642bd2111549160cef9ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a5a60f825642e70f2481f53b6c435663

SHA1
f15709400b38a94ebc3b53c23fd2945fb32f4214

SHA256
a7a1863972c1cbd6b3e34d184573215bb864d66ce13210cbdbbb87606f4f7dda

SHA512
50e13c56cd3678c4a413339fbff4f05f4d3d518aec1db03778e516b56adce2720390d1edcf407685ca57196143a75e46a7c2eb6868fbc1aa98233a01729cca76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1003da9421eb938e564eed16b268a377

SHA1
ff2eb308677dc365fe7b4e4227a8d5c123638773

SHA256
ee7bc9bc2e58fccd588e1bc628b25702c590337dce48e90dba8cf947e8728055

SHA512
c717be6e624b42ca8e3f13179d5c76cc9ea8ad417d3b8540225a6e6c77cf50c69e09346e5b33275e168c29b7862a2e27d0065c7f771840bd47a1e8b68dcf9991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8c067b40ea9eea36bbbbd137afd1963

SHA1
31ade22ddd380874b128050b068891d1c41425dc

SHA256
10ad0868d1b8ff599473dc7fb25baf290c2ac0fde216cf743266a1a6adb9681a

SHA512
8977edab03792fdf626689851202cabd9cb952ba4525a39b7da97cbb9e28f608238fd71dedbdd3247c66e016b0b3539a0eb9096b9e1ce9a4c8cb5c10b80e52bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c6ee689ddce636861559e96e5cdec6eb

SHA1
2d3fe9b84449bfa059902a732d83d86a7b43fd5d

SHA256
f731abfebea330016ff560c5ab777b38c7cc6fb7d76f48e6b15f3f82430debe1

SHA512
4265bec7db09a7328bf4133ea363c365a14bf905c78d3b77ad90069ebe9951d18900328a7998e065ae1186f48eabe1a90e8d8787d8f4c4146e03ee81cbac2d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51091bd1b68faa457674901c059288c3

SHA1
b896869f10dd3aeacdfbf79ec6bdfd75ca0421f4

SHA256
a306b21664ac3bb515305632c1a4e42190bd84ec7daa2798d670b3e4586e6d0f

SHA512
d76ae27f44d67b6aaf64a393765e9b8569531222ce814337661c54272927a6055ee0fb1081113676d280f6c8ff7d38586b62df3d214ca2abad25e25a4ed3cc18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a58656d86138b20895cf55889a3b902d

SHA1
34b16d218396de828576577b94dbde45ba7dfc43

SHA256
b888cfd7a1ece231934c41927f02b9d639453f1d16801733338be86436ef88f6

SHA512
000b897adab988fabc721fba69405c87230ed1189b0d214aa013b3d50be2a24d05860c1cd4979c56f7a91af58083f62fb3a635993436a0f90fe1639a0c40200c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
0b1bb88f0f9017bc185797f70722c0e4

SHA1
d3a2725ec53fc602eb5d0ddb547fb1b6f20514ca

SHA256
0cb217888051cff9d8c7961220cb4a0620d388746f28088335c1ad0748d8ae65

SHA512
fde9c2742e77d8616cbbb09f2858efe307d2172f61825cc180f038e648a30edc1d978de559935a91bef2c7cb998ac499615eca248794546f02b9cec3412327c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ec92.TMP

Filesize
707B

MD5
9906932e16bc4a82c1c990234d1feea5

SHA1
5b60fe145b1437b84d6d52dd3ef8bd30b39daac8

SHA256
4a66358c2a623a4b7d7ec6f606a4a37bd1db73d7cb7df7864818d31e1a6944a6

SHA512
0d6e1e233505c2bf83e5b903fc8822958875fa0fec1cdf34d4e5fa9a439a60787e3aa6c23fae7c5eea9907cd87984c2dfc0e66d70531267980e6774969fb7044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c3703b3ee736e4f781bb10de43767b79

SHA1
7fe0e2a7bc28e5599335133e115d274fbe4291b8

SHA256
a2e2133f68f98e9d0eaa866c8b02012c72fd1e502f5804d734be488c63582a2d

SHA512
3bf79f473f4c729a01e696f54253f3c1644fa7f5729d56b03b304253e0807d314382c82730b3180e3cc3e5bf9447753bb50e97c8b510108efe8c30349f9c3c0f

Download Submit