5dc94e1c47cdb6ab2eb1b72fbe63957519aac239267cec0967851c1fb75cdf27

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c7c6d545ecba5645b77bc5708b3a5e4_JaffaCakes118.html
Size

437KB
MD5

4c7c6d545ecba5645b77bc5708b3a5e4
SHA1

fa53e2c50dc012d1004db97c6d9ffb20f33f53a5
SHA256

5dc94e1c47cdb6ab2eb1b72fbe63957519aac239267cec0967851c1fb75cdf27
SHA512

7cf4239f34625c41753f01f08a88fba9044d189e4c3542c1a1294752c55e64d433cab8e19c514c53fc249050077cc05490d12abd77bcaf02f1aabcbcde84a321
SSDEEP

3072:Jy4Vxj1KEFmJoPbv9OKH6esBeBPcpltO5LwVwssKEtZmfvNdFnr:OovTPcpltOdwVFZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
3564	msedge.exe
3564	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5084	3564	msedge.exe	83
PID 3564 wrote to memory of 5084	3564	msedge.exe	83
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4452	3564	msedge.exe	84
PID 3564 wrote to memory of 4696	3564	msedge.exe	85
PID 3564 wrote to memory of 4696	3564	msedge.exe	85
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86
PID 3564 wrote to memory of 4596	3564	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c7c6d545ecba5645b77bc5708b3a5e4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb0b46f8,0x7ff9eb0b4708,0x7ff9eb0b4718
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14408167839082721693,9343392857837829694,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
283f9fc0788f7f8aee493bf7b41c510f

SHA1
f2917e6e4906508353d0155d7f1e6015566a1871

SHA256
6459f0cbdf96dd57accf14093dfef2354281bf238e2fe870e4f9f256616ed27e

SHA512
ec9ce1f5da8018fddbf95a963ee64c144b158f2613030b2b7ea842b578f5e21329be5d2cef26596bbe78306cfa97aa17103bf997cbfcfab1167410e1725d2d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a712edaa6c7e664dffdf91c1d56ff99c

SHA1
1afedff1a0a21aa24f87c71e2d9033ba6a193b26

SHA256
d5dac5598ba0f975851a88507cf8833241eb02cf1c70d13b8c948de5b242cd2c

SHA512
ba0ccd1696ccc3f66f0c019bc5e8edd9711cb9f276c681cb5d9e8b68cb7bdb9248f2bdae52825a3a9c82a21c002d0431a7c1af02f850f50d4a6e35036532dc3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e9cbc643de48909f17964382b04f54dd

SHA1
b766a1da07d91313f1c488118718d3487848dd79

SHA256
e498d6dd436f854ac68e4a0dd15a83c1c7e73a411f074946f248b31d680ce200

SHA512
574138bc8ba887205df1e6ff60c23bc4988c018534de4b4f0c0bbb305b4abcf08d0622ad335ff26aa418d32077f57794c172b3d2188976f8bdece789fee6e62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
955201d07d2f24f3fb0d09989d4ceeba

SHA1
9ab93d204ec62ff31554faf627c9013406280215

SHA256
6a63c548897c764fbcd3409b5a04580a547d71a48357f9fb1675118a149672eb

SHA512
96402f5cbb036f8373941abdf5cb2c243eb853088ea4628cfb2e1758d42c4be66f24468b71e1dce3dd8e4690d07ddd3a1f73a5a9a7d8e1f14cf7fae8a6dd3fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa89c0d5da3abfed5c9a3006029733c7

SHA1
ed9f2aabd026dc898e50ce15c9abdf67979aface

SHA256
7268b0ae892bcf348a9ae307e8d7ea650a0bad959834d63b5a0f89d670fb9dbc

SHA512
d9a4821e0a05bac276abe43574ccf900429394169e2c3a208fcc23a8458345e448ffea17b7dbd5cda00a43356230be44cf596ad780f3762c530d9e52ae0f785b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
811d5089b5bb6ec2ef67d31c9f7e2f12

SHA1
7220d92617baaf65545814be2e91d6e183f89eb3

SHA256
1e0cbfd84b4703e5d162bfbe20e049110980c8aa6afe8e25f859f0fabec7e29c

SHA512
8d7395b49bdfeeb682789592edacc0724dc3d3c759fe40dcb49e94f57a7aff965b4f1d4e7fb79e8e6e42ae725c71711662220f21c9f7a7f8496e43e4895abe00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
56cf94f632e9b496bde60a1a7a57d06c

SHA1
c936c33cf40db7c6b8733b6d3a7867bc8fa49b70

SHA256
5f143aab406d4298051f1d6e4ee5c73b728a9fbdb704f496657df8a4fe4d878a

SHA512
d4d380b8831fe319fc4c178e6163146ba2535234fb6cafe2d3990c605a684c5a90f33752552ead212baef2eb60f36d562ef37781088be20b3afb20c2324097db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817aa.TMP

Filesize
372B

MD5
cde8e7a79e84ca91efb85d8e3607cdda

SHA1
2ccab46eb2985131df6e5ac1ee179b1b9df00fce

SHA256
20fe3a8565559f684617d7487cc6a1773df0064830688f36ee216aa48265cc55

SHA512
a259ed16331d0394f6672789009048f4fc786bb158fa05ee4388afc9b26eca14c95c0bac06b3df9c8105eee4770781a23ded360247d80fa4e90081fdcee0608f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0a5dc06f8fa006a36616c1bc89b1193c

SHA1
41da27363eba398a6a14f956d153d0f5e8a6906f

SHA256
31e849c9f481f98c01280366d95bdc619ab0e7bf80851cb708bee35ee58b569b

SHA512
961dd35817764bfd978ea928224cf548127be1627e515e07ba9b86653fff75624d486c35cc05bd90228d469a1c1bbcb7502d29c653bb9a65d9de2829c4561349

Download Submit