41c832e09ee2e74c9e70690118c342005db1452442b6c88d09caf9092fffad4c

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72cb0d81b41a53bdd44e33922a048312_JaffaCakes118.html
Size

18KB
MD5

72cb0d81b41a53bdd44e33922a048312
SHA1

905d3b1d9b83a472dea0f49e821b16f0c09b7076
SHA256

41c832e09ee2e74c9e70690118c342005db1452442b6c88d09caf9092fffad4c
SHA512

8e71e985ce7978087bb1e8bca2c0d33acd174521688ee2e4960f9f699ecae4787ef6d9ca85b7904003180ed375775f69a63f8670f04098300784eff1c104667f
SSDEEP

192:eV1hh5jcncyFQbHQa9XGkyH9iQzTp8fEIs7hZm+KSaOek1vpEBnrQ5iOqsFJzODT:+1cnx8n9Wb9C0hg+KSte2vpEtAJSi2V

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
1184	msedge.exe
1184	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1524	1184	msedge.exe	84
PID 1184 wrote to memory of 1524	1184	msedge.exe	84
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 3324	1184	msedge.exe	85
PID 1184 wrote to memory of 4240	1184	msedge.exe	86
PID 1184 wrote to memory of 4240	1184	msedge.exe	86
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87
PID 1184 wrote to memory of 516	1184	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\72cb0d81b41a53bdd44e33922a048312_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac95846f8,0x7ffac9584708,0x7ffac9584718
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16282111979248705389,5759398137580593520,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\274da5ca-e7b4-4865-b845-47c859084048.tmp

Filesize
8KB

MD5
71e0625c8ef1bbbac8c77b926000fccc

SHA1
4d27b9d1be73b93cbb28042c4c74462f5abd3c4c

SHA256
e903d0389741d4a2397d0248f7272833eaac5662066dcaf5fbd8e01f67d333ba

SHA512
6b3433122e3184c766c2f53f5331156dc2b37efc600ca3393ee771e335b21198d3460befa23d0fc42c6eb77f741bc370645a6fab5eda8a4683cfcb9ede604490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
d238a938e868d53484af0d46ac51c600

SHA1
c017d47bea81a8e49e473a429d5de339fc2304a8

SHA256
e02cd37cab44cbd0086ed63317d89314d261e29ef5306a3741f5b554c5df951b

SHA512
02970ef4edf69382172d28a28ad483b86f7c5d4f157d6944e7764dfd6e97d466eabadc87d8f053950800300deccaacc736087471d008de0321e79dcc6be790ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f308f8d1981c28d913996e17cb98c517

SHA1
2678d8b878be2e2a2d1223c19f56201505c8c9e9

SHA256
33045caa45e2f9c0f4f6bd508de79538ef703f3376dd3cd4746feba439b238f7

SHA512
2f83b11c892f102da06f496484fc4d27415fbbc31fa772109c0ac164f9318f6be80540c85419a1f9871d1f8f5eb5e878952995c8b4b6db04ab66c84cae4c4de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
067caf8118d11b78ebe6775a02997f2d

SHA1
b16ab64c3c5397de97f06a3cdf0b57b6cfd09a06

SHA256
82ac47c3c108b58396ec1520db11f31ee68693fadfd0cdd37112a5a260611ebc

SHA512
b62a117045779c7f3d5a1de2a7b97a0ac493e1c898f4dbf09a82eb01c4f3a53881b982a6dc4f794025cf027ea9116b0898109b4b778301f78404c03ff0a6b7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bf357b93ac3bc834ddbd1839b2aa739

SHA1
869fbc0d23a8a263a48e5487afc27ee792adc88c

SHA256
bfc09d61cd35fcea04d9068179e76239455a4949d8ce4bbb84336829bf5e405c

SHA512
c1e2aa88a2192d5b47b46ee27f4d0ff1513eab52edd6324afbbb5671fbaf3333821735622e82d15d564110ddaa12bf920b96c9dd9ea3293ab7643030e3abad2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce836b96ea5d11050f4ec5a216c33b0d

SHA1
fbaffb4846d0302cba82897b51439a0197311be1

SHA256
815b0eb842f49cdb8590ea0ad58ba88763591c82adc99bc817000cfe2de114d5

SHA512
371a5d689472311d963e936401cdda3258e51f82dfedfd83e9efcb03edd73216b67a2a16ace19c94f90ae420afc1d8875d75d00c31faaaaff6ba4fab0b9b8d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
d52d174519656737a6e8a4c6396adc6a

SHA1
7cf2eecdf1733ce99987c9f6db7be11229433674

SHA256
728af47861483f7c501f92cca05f46ab882d3ab8316ca73f38b13cd50f2da632

SHA512
1e36ef3467e51049fd1f7827083139c910ed6f5c9dfccd53d8bd3365a4b5b1e2168534c089286eaca44d85b2da4fdc3f444caa146b55c7de8a808864062d18fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582304.TMP

Filesize
705B

MD5
b55d77c88913c26c76d71aca3b782959

SHA1
d8041381698bbb9b856a675378b24306275c5239

SHA256
b21b84175b47a49c81e494bfb4c47d3187a954e9d6b43c78a58b5294a61975a6

SHA512
8b93931e9a94bb0e6abfb66cce4298f2a748020942a030c381195cf3b66797ff36e1280101c6bbef93ac3f453981a2ad9a45badfb35cffa29785f249aa6b037c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit