b96d3f78e1e66784effd66e124c269c010985d8876e0e16462a1e2fb16d7a7fc

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a612ed14028267bf5f7c42cf5f52d0d_JaffaCakes118.html
Size

72KB
MD5

2a612ed14028267bf5f7c42cf5f52d0d
SHA1

d2d349a1cdbcc611490989b8d069806044747ca7
SHA256

b96d3f78e1e66784effd66e124c269c010985d8876e0e16462a1e2fb16d7a7fc
SHA512

5ca186ab4a7169c8d27b325b5debdcdc4cd9b1e97f3be2cc95ef01a47b28628fe639782a309a7256a6868941a4b50297d7c6e725831bee449db77a5441686068
SSDEEP

1536:0Gpdl4bgtkYWa37vnIeApBtWsrWjW0QZAcHC8WXY0i0aAb+K7zV0WuJrHjLgqner:0Gpdl4bUOCv2pBjrWjW0QZAcHDWXY0ie

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
1400	msedge.exe
1400	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1212	1400	msedge.exe	83
PID 1400 wrote to memory of 1212	1400	msedge.exe	83
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 4972	1400	msedge.exe	84
PID 1400 wrote to memory of 2492	1400	msedge.exe	85
PID 1400 wrote to memory of 2492	1400	msedge.exe	85
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86
PID 1400 wrote to memory of 1688	1400	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a612ed14028267bf5f7c42cf5f52d0d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90b9346f8,0x7ff90b934708,0x7ff90b934718
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,17834840687104320319,525614456782413721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5be2aa2b-4734-4761-acc8-150fdca51f33.tmp

Filesize
6KB

MD5
ef9631c7845cb45e8c9ede1bc78be6cf

SHA1
b94cb28e47775e5b9453fd07aa4070be9354fd0a

SHA256
f427c1c791f96e699af32384e8cb3891b7792e662f3b693f42c24afaf52220a2

SHA512
7bfab76c721d3eb9718e1610d24cf574aa9ccd30afa8d7e193ebc2ea9a5fc1838bb14b84928b305c029f6137946b517312d625e30b9c340210fa6013088b76cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
dc8da721d71dffb265c30ee2b2873017

SHA1
c0b7507cbc9875434a4d18f7c0e77b1ca38848b4

SHA256
56d9402d9767795160b88743ccb3771b4cebd55d287aafacaa98835b8ad548e8

SHA512
2bb35fb51f3af31bb554b34a41f8b4660dbd30ce21444faebfaa3951f2b2231d1bd704d1f830d725c39504cb8b622cf17a2cdd699369c02b4e0aafcbdd666675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
46e3231e30812fb7b697f79c28f55e3a

SHA1
361276010f35c1dba06c1d42d4acca28c76b8a17

SHA256
67e49902835c30c042a32c74f1368d9fe7e604cdd0d46c09c50416e8082f14c2

SHA512
8dd11308abe2b72e5d4bec6965045be23f20b6ee4cb85d22239e98f42c5df8c5b23ed3dd6248a2c86f4e5ccf61f20310849ac9f66d6c1f22e52d3dbd4010f06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d6e6fc07151e32e4a57218d23369105d

SHA1
c4693c69b525d286e87652827e63bfe515059345

SHA256
e591ad278692d40efb17d3dda5978d9515c35a615b7be07bf2c2fb5b3780d8c3

SHA512
4d303a2a70696143916d005bb0bd352e8a1ac2f5d8d778176a4ec4aa3ccc57db93f7c28163e2d480a3d89321ed54afa51dc0df79a7face2aa1d67c3e66add468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
415e671b61464bea88a24f7a8d5eed3f

SHA1
d1a71677c79723b26db6f40544309f159a53e540

SHA256
0f91bed2c01d76fb988a5fc83792e527afa1811afdd357b938631de124795aff

SHA512
b0efcce7fbdcbe8cc7c938aeb5d6f14617876bd60e379b310f691b0bfce8f7b8ec125174684307b430766c261e74ab18db5faba437939af203aafe827aaeef9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a8be.TMP

Filesize
705B

MD5
f8e5eb5dfaaada420dc85c7f9ff5cc80

SHA1
9cc2adc7e0d1f847c11b7e40247e6ed10cc78542

SHA256
9c9f11e4147be73527c3bb900c056a4d76fd074f8833e265da63a7c60b9025ab

SHA512
6a7c7bbe9778f4c3f8a3e8b86b0e07b9bf2a8a2f02bc2af7e36ba10637167847c4a700881f86219a55ee4e8e45e9e4a00e490a2ca94bcb73d23dbd0f8849a595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f36725312cbb26bf36beeabb237406a4

SHA1
0270fa27573d2d9a9274c1679e033b05d7e25bcc

SHA256
a2a37a24a4c698e0b2eb2298b04340fe6eece73cf00b0ab575621683b5b1e65f

SHA512
d8b88857cc363bc01874ab6c495054f4499e7412a8138eb45a6224cc633627c119c2a2aa04e6898685f5cb70998047d1d0152918e511fee3c3cad1e5520e1e58

Download Submit