171eab13d4de35ddc73d5832b2f9883b75312c68a930707fb55354212387713c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75a6a3e521096fb5ea08de441140f3d7_JaffaCakes118.html
Size

195KB
MD5

75a6a3e521096fb5ea08de441140f3d7
SHA1

bfecad9bf037b61cad1fcc7938bec6e19afc34c0
SHA256

171eab13d4de35ddc73d5832b2f9883b75312c68a930707fb55354212387713c
SHA512

45cafd8e137b8fd4a6376b8300accce42e712137881ce5fa73e414e92d6579d688306840abfca800bdf148dd5c0395216976184b6419f09623f2174ea6821751
SSDEEP

3072:12hUrCD7NhK9g5tCt0xr3VkVdhmJj/6nvoRcBtwdaAZvodWhVeo0QZOXnTyhb:12erE7NvekJj/3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
4156	msedge.exe
4156	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 540	4156	msedge.exe	84
PID 4156 wrote to memory of 540	4156	msedge.exe	84
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 3132	4156	msedge.exe	85
PID 4156 wrote to memory of 2568	4156	msedge.exe	86
PID 4156 wrote to memory of 2568	4156	msedge.exe	86
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87
PID 4156 wrote to memory of 4632	4156	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\75a6a3e521096fb5ea08de441140f3d7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa662546f8,0x7ffa66254708,0x7ffa66254718
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7233102941924196674,15221818785037377354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
5b7ac0adbfd2033145595b360b1dedc3

SHA1
abeab69588997800872efc1eb763467beba8392b

SHA256
79ba8c3f51e203cdf2b10a636b2f52c6467fcf9f74c8774e31ba6091754316d9

SHA512
ef23210e0b626bb4b047126b50b3f63811639a71bbd464677fec7ef275241b44700477b0c7e5963fb532776fcbe8ec39155b4f6718eac543dc0cf50cc3f29310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
111eab85ac42b38209fe347ad57eee71

SHA1
d4cb04292e07743e618775c99eafc6db2826eb04

SHA256
3f26a45d59dc08965d801774dd62303c055f960d47b310c7636ea19b24177ed7

SHA512
50a3fb770bf435310d738757694200258f2e3629bdafacdb12a91a90fc33066a702ad130b1c3311169bc25c855069189ab727e6b59fc69f2254c88b0f0c3563c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1fdca784001762c253a2216ac7f90385

SHA1
d51ed4c148a8a00fb6a16bee95dfa84cd7edefc9

SHA256
0baa33042c3139972baa1b444282e958de4d9a81a375a81af0b3731a53fff72f

SHA512
27300858dbc5616f03848de32ef8daa22ba9d2ebd7e37f5ed9dee28cf1b432841d6449771eadd428f226782bae3357427d92a2c72e901988339c8fbad2bc9c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a033ae734fbb479a8396e53183fff7b2

SHA1
a62108381218155a9f40437efaad81dc25c4040c

SHA256
74b161f4ff9f8fd8da5db2d434180515a101d7e2caaad14d32c18c636841bd3a

SHA512
9d6a209b398dc08a535fded2a0fbca39b8248931796046e9f63d63de7d62ba52d5bdc3f17a92571cb3ab1cdb173039e23e683b7e090c1c08a9a61d2d39b6c0f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
736a8740924fc2b89aa03c051a0c0ca2

SHA1
82fd5d4da1bab2db3da6369e9966fee2894b33d9

SHA256
7ccfb297b0ed14c63ed45c105b39cd64d70d561b339b109a867e71a3b82f64f0

SHA512
47d9410bd924556a59a5ee9aea4e5b5bc52b7c9153a43796ba25d201a4f68171d91ebf5c18fba209c0276fcb5a0fac7ec2d072b882fd885dce5a85b670c356da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e1de779a152a80bfcf42e28fbb75957c

SHA1
a99a2c14f1d0ffc2d1d53d5d3f06e31396653d2c

SHA256
6c7a4c8d86275edb3b567cb1013dc8618e28b6805ebc7995f4ba584f7c22efef

SHA512
f65d149eb3a4e9be2c1d3f87eeeee5d5477e164a0e27e38ec53d0a0a0c5a6607090ac8496844a49610f37501458e2ddd0e99ac0041ad21be0799f5c5abeb1a29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0692a09389e0eb7a809ab95f8ab068ef

SHA1
a50773ab02ebbb0c4ded7ddcb5869eedb6d3b032

SHA256
dfd3b281e7b1158320c587cd3251ea3bcc9caa03c2f6419b17fc09cb19e68506

SHA512
c7cb957604748e555ca37e6efcf0e53f84477588a25cae46d358ad6c40218c948a41e1ec0fd3d3e5da0b67ad303a1378abfef6a3fb0db9d2271c237435da98ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bf92.TMP

Filesize
1KB

MD5
feab3beb725299ca40329855fb4adf0b

SHA1
0dfcae4bc33b06139f7aedf86e89ba37c9b1a149

SHA256
0ac4405c143044a1668ad3116446420cad55cd070002ece6d41e73472b27a2da

SHA512
af54c08d17830901ab328e9fea939c481e26862267d4f679af510b8ae9752aec8922fd0d39e4d87d084eea59ccce2bbe9fdae84016647b9e22a7b285043b9337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4539cec4890c4ed9921beb5083d106bc

SHA1
d7089798fc812ec2e6717fe7bfc0e7a38ce70a3e

SHA256
7fb7eb38dbf16f4282243d488f7eb5fb09f549dade6668e03e9755a4134362ad

SHA512
51dc224857a78e35ea36c660b0c1997487ace9c7febf131ef7ccacd6ded667c980bfc5a358075ced3f065baf98dceb413e74343349f75900d8c00dd1ec699982

Download Submit