fbff3bc1c66dd4e5e8370b72a482e5bfac6af64e280d4650c4b21713496b5e70

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa6c6fd11271bbdff3e2afaf890123e_JaffaCakes118.html
Size

47KB
MD5

8aa6c6fd11271bbdff3e2afaf890123e
SHA1

9e65af92bd5a4198286e0ea2a06c3ad0d7fcd2a7
SHA256

fbff3bc1c66dd4e5e8370b72a482e5bfac6af64e280d4650c4b21713496b5e70
SHA512

bba6cf16fe89843404b4723687a56b10de4f3a8290b05e640bcda35b0b05e06b55a14e5bcb4b480006688ed77091baae3a4bfd17e8dee567d2faea859aa63ee3
SSDEEP

768:b8iombdopdryHHvPWBoRwLqHPpUysHgH4szC4HnxXIXaMoDbP3Z3wPaCPEKPbIPf:/HdWWHH2BqwWHZtRVt6/b2GKNKMt7HTf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
4740	msedge.exe
4740	msedge.exe
3040	identity_helper.exe
3040	identity_helper.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4516	4740	msedge.exe	82
PID 4740 wrote to memory of 4516	4740	msedge.exe	82
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3912	4740	msedge.exe	83
PID 4740 wrote to memory of 3176	4740	msedge.exe	84
PID 4740 wrote to memory of 3176	4740	msedge.exe	84
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85
PID 4740 wrote to memory of 4804	4740	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8aa6c6fd11271bbdff3e2afaf890123e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6803820724581383068,1069407641670331253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\759def21-09e0-41b7-a67c-4a27a6417c77.tmp

Filesize
7KB

MD5
770a1cf386af002d0d8308459ee8544f

SHA1
cdd0f90a8bb6de5634e4db5a9763d9d699dd5086

SHA256
76470fd29cf1697c3077605a26d4e3b9682a03a329a31ae98b9690c6a231ad07

SHA512
0bf4410cef7cd749f92cd988e704ce71b8b1e1b7d6697cdb7d1ed9f6e11d076f291fdb58472beed6e16ddae85c2745a3fc9e9b2418eae232fae186b55bae561f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c8bdc83e3345bd3687c38d0f222a29c8

SHA1
e9ae55e6d33adabac90050bc567a0130e5826576

SHA256
96a6b6132ff082b4ca5ef22211a902b554588693b866fb33cee1d5eb34ae9b21

SHA512
736e1ff133b49a923927bb287a0c083611ef8be1a133036ab894255a13b9fcc03126ffca88dcc3bdda704949b70d6bc89d76a2de508cb2b6c0108dcb44b0398c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
68e1846be873c36fad59976915bc35e4

SHA1
6020b1add4507fa1b8f47f2d8aa0ca3ab1cdf3ea

SHA256
e40812a02a71297a2a73a162e4d5158b26bc691d8f813d75a49f7bbff4d23db7

SHA512
5d21c679ce55135531786e00fc184de09368f367dbf3ae4e8f4f466003050d3a078d9807fb20b888ccddfc67b01aed47faf630e061ec47ecc815550f28747002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
863173d5c9d2fdb4295942f3d03ca86a

SHA1
f7bb82d4d0850d811b05e5f0d2b41f3e50d62257

SHA256
a9a38db265210ad2d0dbb8acafb270d31fcf3686e4655d23f0bb5cf4696e7340

SHA512
e2095dad8b948158f9545adced14fe399e9e983d4eb1e4e29ffbd60d10e94b9c4a145a016f1c4e909b0954a6cfa5333374dca4bd4b8575cabb0729f31b9d4d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6cb62832a61cb5208eacecbe41c505a5

SHA1
8d6065de918f4976919feab427e126879ea3d1fc

SHA256
ea2254570373b2520eed94156533f52360fb5619866556121eaedfd9c8c75267

SHA512
ccd0cf7cc87843071a9d80eb7cfd8fee4b125308d3d4a40cc7b1082d754c204f635b526564b6a3de59f29504a884873346cf87e8e8b3bf862296b0c0854dc31e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3f0e2073f7a93a48ce560c92b693ce9

SHA1
85d54ec01bc0256bc9f5c428af79d45ee448ed8c

SHA256
cf68e2cdebbc97fb9e1c45a068caa1feda256c1862209bcd7e82dfbfc6d7bdc3

SHA512
418905d98f9e7d2679d880645f8ee2652613ce1724c2594ef06134984feccf7573c8c11d94295b5a5b71bc40065c8af2479b2418e0ad4910a0ed5f6d8609c67c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
fa73e479e1990241947fbcbd3457c676

SHA1
3ad68e6be2f6a0eb5e46a8afd85e27acdf093216

SHA256
88628600e32792fbad4b26010e2cd7e7710f8625c3ad2ee354e1b82e5570ac94

SHA512
d2684b2f8936c1c47b1b38e94d6fce92f3116a952e249efae1dcea892f8a52ca97f9326817ce02beabfc34f0d482342ea1ca7c43a915d51f0c996b39deeae906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593195.TMP

Filesize
871B

MD5
bb063f5945d2e06b148c83d6cfce0fa4

SHA1
f488e0141b80bd5f85b0c816b73689551d0ca038

SHA256
a10842d6e6fdcb9ce10115ffc1db143625d80e4c7e82f4ccf1eac4dbc34f3a75

SHA512
c31df5fed528991e5b1ac9f50315fdec32b2f09311cfeb1fa3280169be12a2350a26a3fd21d1d5aaefa353d2555916ed067a5c51fe1c49da22ba4482590450ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5e11293675c7e667783d064d01da3141

SHA1
7edca98f582ec6bceb6471e493bd6e391f343db1

SHA256
c72f0fc68ad355459512183d46a155b09e734fa28b0c4d539d7e02e0bea71d5e

SHA512
b4c9d7d9aee0c5c28024ce1c7ba3c27b783521df611c15c14ca9f4251615fe6fe0077e7014a4bcb2fec0779b94973ac0b592c3c9644309020e47a5ee05dea5ff

Download Submit