8f8ef2b4b5931079f3ae17a445a88b67f74f614540940a72c2c101d0fc2193b4

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e17f46012c51230ea3f69c7a6bed50a1_JaffaCakes118.html
Size

105KB
MD5

e17f46012c51230ea3f69c7a6bed50a1
SHA1

57553b365232963d3b303c8dd61dc32f94b9fbd7
SHA256

8f8ef2b4b5931079f3ae17a445a88b67f74f614540940a72c2c101d0fc2193b4
SHA512

3a7d87d2ec7adf4a58f3ca1033baa125ce1ace4dfad71039b122b727511348bed462e204c6be62ef297c75239dc6bd72e88a2c0912f5bf6f898e748695b6fdd2
SSDEEP

3072:Khq9GLyTmBnOWp5xubZOEBwyw7M8J1bZelG4tUL/9Y2tnqBYcDiHR+aKctoSNZps:j9bfy2b8EBwyw7M8JdZev

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3216	msedge.exe
3216	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
2144	identity_helper.exe
2144	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3940	3216	msedge.exe	83
PID 3216 wrote to memory of 3940	3216	msedge.exe	83
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3028	3216	msedge.exe	84
PID 3216 wrote to memory of 3244	3216	msedge.exe	85
PID 3216 wrote to memory of 3244	3216	msedge.exe	85
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86
PID 3216 wrote to memory of 3212	3216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e17f46012c51230ea3f69c7a6bed50a1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1280 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3023551567322056804,3470765461403694292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
d1aaca27ca84eeaea38dd5380d065738

SHA1
0d510f0dc7d0ef04d165f4e07e829c1341bb7a17

SHA256
12ea0a88816564c6b7356c07fd44d3763b3e2171b6c191b4a8654cd7543ca4d9

SHA512
080b590cceb2519375c8a36053fae84a5680f500b438f85936fafe855928ea33071d86e340e3d85c4d8192206ebe92ed6e7aaab7062c42206619ed3b2ae28a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a8045032977198ccf2b6c77fbe7d3147

SHA1
325902bf51318066046b6c23beb0af581d9cb3b8

SHA256
5098fb35a14aa0c1231e9bfa88c9527c501e17265425502a4b5bbf416967d237

SHA512
035cf33f2f83144b000d453f581fec0d2e7fd221da028a21616a774467c692eea400656c48518d9a90223bbbfd8e430dd2451c0807612707e3e4f13205747310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4b1911c116fe8d4adcbbf7a79015b13

SHA1
d0b25e8ed09ce6c066daab83cc0c820ac83b236e

SHA256
059d7d3faf4a1284788814b32fbd4104e63453565c9afeaae7466b017167a44b

SHA512
e89e3aef60e79112fdb701ba3b21398daab0f3e5de27db2ec536aa3fc7ea816a3b09cd253ec01b00760ec33fc984de73a3697d9cbb3f317c7833a417de809745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05408f4168b71db188bc57168283d259

SHA1
0a8eafb77e2f0e0db7b989045a09005b47896c1d

SHA256
b452047c845bca8ca48614c414c5ba3c52f17970d925e0b0a6597babacfe9e54

SHA512
0cd13081d0c358d15a004748b5795f9a2d66c5808b594d9f78fa2d1a726c7bd466a5f7beb1c57f9b9ec873b92cf7004d2485b2173c20a07e26c929e66cfb55f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf76f62ba73e286036baa6498fef6925

SHA1
658bd306b878e6605256320cc2cd082b05e13138

SHA256
2ba6dc3b119fd80bb61b639163e8ee1b92a00f473199f294119ceb6be35e9e4f

SHA512
c461017080041fac33072e9fa820b7661b7881da4e854c0a5eb3a91dfaddcdbb61fa745e27a41a17e1a19fa07b524bd31f706fa424d7f4943fb7174f5b8e3b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
524a49778645b7ea9b0a2c21eff44238

SHA1
02c5b9e2e14bdc0a5d280eb19465a2ca12197986

SHA256
74631f6417f63e46ff8c2af801e2d25376d2ce8f311aefe689753cba3e389899

SHA512
82a3437c1e2f98fe7c9ed0e868926b28031edee37c9a9b480df0b225911d913c4291f0cbb1119466da6186a70fd0b109323e3af03e155ef2e871a015812da52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
06fca875bd5b171d4de01f9de74ba5a6

SHA1
0e3b6d7ba24a27337afefa3aee6613acf0732b62

SHA256
5960d97dfa0ab5fa3fe67bbe60088c6aa00777b3d149fdba79d3b3f2d7239487

SHA512
cc75d147627530d421555582a884e15973b0742fa474eb3ef503c1adb2533887d3ae48cb929e5876a1b4673c01f8d5cfa02c347e480a4d9cc71a79eaf9a8d672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804dd.TMP

Filesize
203B

MD5
ef04cbf94ccd32dd23c060b701f43bda

SHA1
1dae59cbfef69b6c1a7d40b4c8b72ea315289182

SHA256
e5aacc6d7631aa902b552f2a42ef7c84f5d79a97abd9290b78a0279d02e87130

SHA512
f757f973c9e10a38daa3bfdf15825bbb94693c1723389a37ecde4cb9b2dfb23ede2df431d5f1cdd5716fcf93d66adb810695304d83aa142cef2f5108e62b1bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
793e9570169cf232e0c08e8d407ff6cf

SHA1
ae4e27da197c59304e9384ee869cae6984e5e126

SHA256
568606682973d93aec4222e8dd27c7451e7ab7b6eb55aa76f049e25f51304eb8

SHA512
c09540d0cb29e759a884d0b84c949cac9226a632c88ce68292e93f0fc03b33c1424f916febbe578b86512c8b9177151d6afebdcf331b344491bfe057addcbbe7

Download Submit