f97fbfec2f13493e9044449c6e83b4520264f0a912b44f3625781fc174007ce9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a67e7331d64fb88b2102688306fbe7c9_JaffaCakes118.html
Size

33KB
MD5

a67e7331d64fb88b2102688306fbe7c9
SHA1

499a46e3f8bb4397400c52b48e7e88814b1724ae
SHA256

f97fbfec2f13493e9044449c6e83b4520264f0a912b44f3625781fc174007ce9
SHA512

9aedf255190642b061a0b3c1f7b3cc50df854e098dd7736b39fc2767610d5d1ec6dceecc253e1796eb6351759b985449ff1d151c7a060feaefa087bc4843621b
SSDEEP

768:6qvdohhim6e59KnqVSiYYTSFp03iP5M5XOy8AxGS:9ohYm39pnTS0X5Xt8AxGS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
4656	msedge.exe
4656	msedge.exe
1604	identity_helper.exe
1604	identity_helper.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4312	4656	msedge.exe	82
PID 4656 wrote to memory of 4312	4656	msedge.exe	82
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 408	4656	msedge.exe	83
PID 4656 wrote to memory of 2888	4656	msedge.exe	84
PID 4656 wrote to memory of 2888	4656	msedge.exe	84
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85
PID 4656 wrote to memory of 896	4656	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a67e7331d64fb88b2102688306fbe7c9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe925646f8,0x7ffe92564708,0x7ffe92564718
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7004652082323737501,7804618597421529302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e90fe02b641c0b6f062dc7651f3a75be

SHA1
2d7b15dae619fdc4cd332922cdc1df4fa3eec810

SHA256
19525ac3c4d1515e407d03b61356d2b95f0824fbe04dcf388c7da8d4c28f9287

SHA512
85c29e6d4cf634a7f24fda6c67c8d18aad235716688b34408a39101edfd386aebc07e126e46ce711d200610826fd7ff583e4b149093ec2f5f24a42712c6edebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7c57a4572266dff055553a4f6a90a59f

SHA1
c2b96a37793b6fe80453fbdd5549558462c4a771

SHA256
dcfa2ac91d28ef126fc938ecf4ac18c2f9d22a83282034b85e11e054f3a2389d

SHA512
0f30ffaf97dc1f6a3c2260b0e9f9505fe00828e0e0093ce8d361383998e3aea8f0b5ae6cd8bc3f566c4fded8f49c94a48c5248f15a0de9d7dcf7a4955fa57c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
00b3dfc31abd471b33a9b9dcdeb1f0ae

SHA1
1a86191e563fd23a03f73a3a1865482e81875c60

SHA256
613cd6c318ba4d1fabb235896ef0bd73b056eaadbeb9a0a20064e88200da3b60

SHA512
810cf3c22fde786c71fdbaabf2269cc599bd8d34b7d9d4af83e0209e1302f4b4f1a4b6cbc5108d3f2f2d250e5b07d672eb23c6d8f11b62e98fc8cabc2e65bcc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ab5354345bf7616917bd86a2ffa309cd

SHA1
2e13b906d0c682c7db014a7c969256fe33685c79

SHA256
5b00d13e9460630d79e2da953c7b398f47d9c3bf4201b43d33100716ca0c6945

SHA512
359ab3878836699cb96d77fa7ed22c567c9d4bc6ead1f649f2528aef33ff135512408c9b855af93d549017dfab2f90eb59f97bbdbec42d9f2773e51abb747675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad23f815be1f36d42a39e4cd13e00b26

SHA1
cea598f7a99313da451024cf41ed7e3c0e586a67

SHA256
fcd1be66a7457f2ca8fa1c83ea29e06d77028bb8735544b579f157ac17a8b501

SHA512
4f116343a2234aca5875518bb5514d49ee687d2d321216ad7e152e53dabf5302bd801fc178880b059fae885fa15d90fd75fe8fa0ac98e1897c36d1890d3b4f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
be507673d6831b666eb0d2ea1b516a65

SHA1
fe0b75e335ffd7a4f059e7356c23c0a9c860bb56

SHA256
0b1e0ebdf18fe389047b034c96f0c09f9f7d31e39e3f3685c33cdae74a8fa0c8

SHA512
5cf939ab46f728326dd8f88326a043044604e6d2c963c692796527f65e4beb9c28b7570bd25cc45046c87c4472ffa392b5a02c245d06e3eca972c283453e3ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e61a330a01cca56d5361a317b680625

SHA1
9b863ad2d696dc4127a0c0fef6c50762038ee30f

SHA256
83a4d283b686a325c3343de0cf156382e450b6d7b86ecbeb79612a707fa1c06f

SHA512
9d814c49cd3d822fb98d52ae7d0570150818d34dc930c4e35a770bcb850e1cf53dbfefc460e3002f5bd5eb544eb4e0ea008100201f9b177b0f1fe0f20c3494e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a6e94e4442d307f190919b47d61d89b0

SHA1
5a0fe06e3276488ba60efe393bf2cd687d88e07a

SHA256
f4d9d4e93e0b74de6548e2bbe460c6719e4b2c5526e9f4a9fc2a5d389695abcc

SHA512
4a2560770167fef100150929230aecb48ed69cf5fbdc25cf21464a57c2a23303eb402a5fc3dbc9387eb05a24db53e99f9bee69c86d689523c8acab3d4f0caf4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
28f8c7972ff68ae960f44e037b8e8a68

SHA1
11cfc886b278603be7cbf1b8bceb1c022244b856

SHA256
ec9f8d36f10016d4355e7b2338f2276171b5a7f067547cb9e01b9d03df1b5b3e

SHA512
27170968de304449d480f7ce008ccbc37dc563cd79b18a48eb2a2449744163d67eadec18b43af6d7ef3e580d1ab3e4ebcbf6ae13ccb6ec21145139ab3c6571ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
7eb7706667a6a70e51ba4748bf4e0897

SHA1
d0a63265e052bb9b6622d5e65d7b44054876da03

SHA256
bd908f63f86030f64164b2e8df1e155c4a4d5e4e6844c707ed620e094c3e9868

SHA512
ca58073eda1a3f06d0558922d90c5bd119177e1eb5b734928d3d2c51cc3beefd1f6c1cf023404f1569b189f38419ad2b901d67de9a61961285112ed813bdac12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
85cde0eaf874f2c88193de5da6ab598d

SHA1
7fdf10c3023f38786c5e966910b34842b453d9a6

SHA256
a98deddc73a9ef1b7b003619a1aa695a22893804c469025171c46dda8bebd5ff

SHA512
025429e61ce5737266e147ad1aa95ac4edbcdec3410bae46eb38f059a0c48326ec5344716f411ff1d69ff08eee2807ef474f9c9ccf2f0c9f231b5592314e6fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
55cccd41a61d580f32a985b761a7c1d7

SHA1
aa6410abf9d2b425ef56829182de8f98a7ce1b67

SHA256
cfb3aee7616534b72fefd7b673d68e34a8d5cad09007dae3c73a07167ea2f33b

SHA512
9a66dfa8150fcc23b758e35bf2e15db93d8ac0e7a75b84530932447cfe3694f52e24677e5cb8f6ead241ba9d0226ec302305f088453951836e8792e7ebdd2484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5793f3.TMP

Filesize
372B

MD5
2462284877635b0e6ab021b40a032109

SHA1
4bc8722316c87d2f6d843ee6bc4bb820b8211ad8

SHA256
72ffb3cd09697d0efa5d56dbb8fa93489c4fdd6b467c776e47d13faf1080de9c

SHA512
568d7cfeace42254dd585491b78bc6a0964ff46168cb08b60cdb5de9241c2c2145563739068a33d9d242cada6e2e0f0937d58a8da01fd613f66cdfe456a9ab37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3deb85a8d0b2c69700ae17148585ebaa

SHA1
9b0252a5b4ad0b27aa41fa3049403e7a2dc7a849

SHA256
e906862fc33f0be94cba24d27880a6faeafab34adbeba563316fb42db1e6773f

SHA512
87b3b678cfcf638de6f636bf680d6e7d30ac702456dcecb39e3ee3f5778cdc0c8ea8ea9421f815f4ab9d091318a36a447175863896ee3a226f769fca40e9a2e0

Download Submit