6d49fc299e230c7335a71185d2a49b6890af9609bf9372238eabfe84526255d2

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

becf62f20c0d336d677f340ec6efaeaf_JaffaCakes118.html
Size

50KB
MD5

becf62f20c0d336d677f340ec6efaeaf
SHA1

dd31ea514bc84bce82e90e7195e2ff729957b143
SHA256

6d49fc299e230c7335a71185d2a49b6890af9609bf9372238eabfe84526255d2
SHA512

37a9034b04d84d04e350cec6c17ecdc6f1ce80640a2baa5863f197db780a5ca27a67401ecc68df15d2347dd0dfc9fa78d3eee111073fa799747b5d5ece7bfda6
SSDEEP

1536:gww7FDMtXqFhVKrdhVKr5y2Hvep1/+rwZtKR:gww7FDMlqG2GLGwZtKR

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
4224	msedge.exe
4224	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4996	4224	msedge.exe	82
PID 4224 wrote to memory of 4996	4224	msedge.exe	82
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 3580	4224	msedge.exe	83
PID 4224 wrote to memory of 2124	4224	msedge.exe	84
PID 4224 wrote to memory of 2124	4224	msedge.exe	84
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85
PID 4224 wrote to memory of 1496	4224	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\becf62f20c0d336d677f340ec6efaeaf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8658546f8,0x7ff865854708,0x7ff865854718
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11945376238875301218,11007813150982498785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ded07628b0cadc45b35323a7594296a2

SHA1
73595ef9f533b4c1aebbfe87e1e50a9b5b08d085

SHA256
f0df6545ee7fdbe613430f7bb5d143fe792b10e02204bd9c2a006f105c90b2a5

SHA512
d8a901d2846ccfcdd1dd231d7ae503f6cb450facdfc62acbaee50d9b4a901e2ed32b83cf38970da01dcf1488fbc903b7aa71f2bc8d32dad4ddf1a8d7c0777530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4f949934f8f52fbf2ecc09d9671d9b19

SHA1
d0e68da3ff82b2565ccbf991fbd5532a9ace8222

SHA256
2d313e27b8a054ba124f6821d073f82dfc189d647efeb02f8da053dfd5b2eae4

SHA512
9e4c17db4948040d40289203ada2ac1b7051557f34d26c895a064756b7d7fd47b8a2f90c3f6c9ea9d600236ccaaebb04f22c071231c9e61b3d0190bf10e1168f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ddcfbbd2a3fa8622f0fb90f1561e1092

SHA1
c88c98371ec45f650acacf1a193f5fdf0947d79f

SHA256
42be0f6edabd8383c20acd1e1cb1c35409588834dc3f0c2afc03c242ba7d6202

SHA512
5aec04b052308a245cec8f528b13485c913ff217febccffc19f7b0ca75a0a52c3a4dfc1a9651ed14fa08dd26e7cb5b851296b8be4806188031e655e826f0fd48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63a8f40b3b1e9f02cdbefd296eddd6d7

SHA1
ef93b06ec3d7c44e01fc757857b014f648b21eb6

SHA256
5cf59d004379141937f7bed068a33bd05c80b93f4474d7d34ba8489fddb94feb

SHA512
33c60c38566595c9c865b1c4fae66833fa581e24de4cafa00072dbbd1d0ba0d95a0f455157b80d329257d46bd48d8dad30e4554768e98f3b6dc3d20fd8a417da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
41701cb30fe38933fcfc3df48ef04fd6

SHA1
fd301b1ee1005203499619f417ae147ed565c6cc

SHA256
e3e09e7a5789a3a733646fc0fff676341dbc3ea549b0799da1304e1efcb7a044

SHA512
8de038b36b4bdbc77256fc497fba9b0cf5cf3f0772c6d46caed2e958c695464ac9ea1345ba84901995e7f38cae09807568e5a4596ec19d3b2eeb83b565d76120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92edcc2bde309ecc1fc5ab0e95c4feb1

SHA1
26baf5df10b7e685ebe0b1562ed1ba383e2ac476

SHA256
a8c8ccaae5f5c55f2fb86baf2f302fb24836c294ea114405eedbffe265f90592

SHA512
5db9d114281d28801845a6dfc484a53e24ed35f562702366eea7c65741ff4a2a1d8cead93c4b13dccfc243fca53fb3093a250ae0d2d094a8cefbe508143072ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
1dcf5425c143505cab6121f9a860c517

SHA1
97ce02464d3f31455edde0e66ef617158ad1f9dc

SHA256
54e5bd6fd3ff9487154605d4ea7d62796377e85b4a0ac085f553228edfcf4758

SHA512
bc2f9996ed11df32e15f1881a80676399a298d14d267b00a450ffac8bf746f56528c6a48aa050280bddae0208e44aec6e6182e6b26c7a0b8296fbb6f98769214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583beb.TMP

Filesize
201B

MD5
74544fffa0bd0befec07fd76ef2a4998

SHA1
b6f703baaae286fa0290904770a57b30f8046c4e

SHA256
693f9265b1b5a4e41b3a48f8965da38e9ae8adac64a743678e306512867d6cfd

SHA512
dd9c0bf224b36cccaa2cd64e9a8be12cf825a754121aea8cd907ac58ad0fe64ced46ef42ab20d1d92ac998adbcb6d9c18d6d81b4bedbab4f0d71d238187b860b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bcc64d3b4ce33d642ec6ea43721bb9ac

SHA1
5131e0bbee4b70099999e82735ec077e83ade001

SHA256
46d35f223a342b148aaae5ddbd363a36dc890840094254854f66d4a634933328

SHA512
810ffbd72a3458e1d42cf6cd8626acfbf924bcee2e241d7288cf1dedf331a2b5da5902e41e56d0efd9c49ae858b866c4a9dd42955871684a63d660af9ce8dfb4

Download Submit