e37a09de7a1bfb94fd2a7bd72f8bebdbd4fdeeac5cc850d411087e410e0e1a8e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d5c4e105c045a00ce0d7a0161984b75d_JaffaCakes118.html
Size

69KB
MD5

d5c4e105c045a00ce0d7a0161984b75d
SHA1

ba66ea51562dfef1333669dad0905a4c20e462c2
SHA256

e37a09de7a1bfb94fd2a7bd72f8bebdbd4fdeeac5cc850d411087e410e0e1a8e
SHA512

b9cb7bae03c10b5c78881c89598aca70083d132035f7f18e184898e7b382167f49c74c7b15e1099598dc176eeca437088f058bb16d081f2f0efd07b95870de70
SSDEEP

1536:Lo3N79+KdKxv/G6d+VAgr+JxM19zi7FNjtoo:Lo3NB+KQuSM19ziTtoo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
1868	msedge.exe
1868	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4592	1868	msedge.exe	83
PID 1868 wrote to memory of 4592	1868	msedge.exe	83
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 4732	1868	msedge.exe	84
PID 1868 wrote to memory of 3756	1868	msedge.exe	85
PID 1868 wrote to memory of 3756	1868	msedge.exe	85
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86
PID 1868 wrote to memory of 3180	1868	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d5c4e105c045a00ce0d7a0161984b75d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8af5e46f8,0x7ff8af5e4708,0x7ff8af5e4718
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14804879042460899238,2538599194820466641,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
2bc420b5f60940e26f70f222441deb3f

SHA1
55871f4547ddda32bb3626439282dc13b1aefd9c

SHA256
f8e59b7653cc0f0b334298e43c67247706cf9d580fd3cc78f6524ffe66f1ad75

SHA512
5ece8438fcac28e976bcd52a1e3766f78e7014db474be1762497575fd518ea99d1130d3353e17b49b82b171678237e1b7ec190801263fc161802e8dddb6793b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
87e272420b774f018f3cf1d62da2a6bd

SHA1
a761e905d9166553cb56c204b7a81082ae3185c5

SHA256
861a7445206f6c3050c1773ea43f018dcce304add5a34b94fe325790b2d90674

SHA512
577e97fbbd4293699444a9134c771daa6064e90421e9603d90db1bd2c18a0420650ec190fe0388eee53cdfc7fabe8545efcdf535d7e6801e85f39b22017f085f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad3eabc4843e8cd8532545b0123a7c1b

SHA1
cdd5cba384ba2b34d86dd42d2b0d2addab5251b9

SHA256
9a3efd181608054e977d41b4f4df029287bd8ec5048311d6c8c189a0ec11c22c

SHA512
abf305c159b1ddbce129fda34fd61af0fd73ea19307f7e60ac2fa9e306d95d89f15c6d6635169a47ec8968fb4e98c431c432e1783a7496245e5956c8ab7e8ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4cceb78a3aa926025c22f3317a5eaa3a

SHA1
7c954b2ff280204254e47b656c6cce210004ac34

SHA256
095aaa63eacb7c6024ba50be1431d60493255bc8d66661fddf301656f2d0a7e3

SHA512
b0d77632722206e7a50f314b364228512925e8565a06fb14b3fefc6bfe17e2979e13c9679fe5e15930c29031a2f1c3139a4acc7f09450dd0f92f86a5326f07ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2e7fbddaa8750b2be2b7e3534b36ce4

SHA1
c9f72ce3b84b02ec75aab6cb6f1ba2ffb9e322fb

SHA256
20d20a1bb7105f9786fbb93cc60836fd06594887de1959998b57f773e353bf8d

SHA512
13c58f1428703be1bdfde2ec6d9d2dc7e4cff7cbf188458c7bbb0bc10ea853dc4049d18240894fc44480020da882b395e48c16a5b949392567e0015f24c3d853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
015071652386e487bf5495f2ad0f325e

SHA1
979b7d79904a206ab9983998d95bc37ab7a99929

SHA256
8bc51755daa23c78ad4346999265ab251b9dbfcd464d9ab4314a9e8d4a7d7b1e

SHA512
3575fdf27ed74e11b998e00b92ab515c263b353ac5ddd36ba77ac01185e8e3f11c4e88691b63e51d120245909d3fdaabd1a0b30cce9bff4b8a5f7e923d5d44f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7405e2fc4a810afe00a9a9cf9e8e7c91

SHA1
f2130921e1054f38f98005f1fd69d3f91062d7e7

SHA256
295ce1d980ab8b1c58e8f15930a5d00f88390324b9f341265106bfbdcacce9da

SHA512
8166abd643367ce65c94215121cd7e554bc201acebb4ac22a0bbbddd5a1087ed8248d71e2c7e08e990b3fea190e8e0b990ce331d273acddb1ee229de618c9154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
826b88e0f6e721a9451d98a67c62b026

SHA1
26714716ac5e4119e32c82279d4a29515c306ef0

SHA256
9a00d03a7ae397260b3cb4bdec5809868732ed74b7b24ba61da933232e6e775d

SHA512
d288068b40c5c55bbb55503bb2d54b8247330f8981b1c6338bb42b2cec8cc5bc92c16996da8b5ddc9885466e0e22afda2ae144d3838023b17fcb7799f5a598f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58077d.TMP

Filesize
203B

MD5
ccfcf7fb45e0e602bfd5c56473225746

SHA1
d198ea2987783a334322f23f89b0a670b0003e12

SHA256
cce2318d10bbc3b9bccf5c95f9ee9823a6350553c90fd1d7c4bcc342c07f45c3

SHA512
0ffe6ccf369b0dec4f2b51d324808b49a6a6e5c387e10e31e879fe36dfde148c6a5c66f49b7cab353f79a676608a029ccaf34a484c75e61699693a533c1a2793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f226aa144e3e323ee07babf899015008

SHA1
84cb2a9f7b705820831994c66de510a7e05e7720

SHA256
1f9ea720e492c55216aec7dac6a300b7567bcb2ea285ec2adc25b2a5192b4255

SHA512
9fe42c036a9dd60331dae15355ed6091b79b8da0c93db616daf03c21405ee5a8e06b26756f96101ccfa778177af90802f0bf6145bdff807387f568a3c87dda59

Download Submit