aa766e38b99e62bd2713314ce47fe80186f096ca1c69e143cd63ad5d2039446d

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfd3a4836338803d94395471ea488a2b_JaffaCakes118.html
Size

232KB
MD5

dfd3a4836338803d94395471ea488a2b
SHA1

d92c632e63b37034ef6e516a7ea627094fe86ca8
SHA256

aa766e38b99e62bd2713314ce47fe80186f096ca1c69e143cd63ad5d2039446d
SHA512

44e131007f207e6768b382bc2650fa8415392fd8ea8013f9de1ad8c541b961e3cf0ef50e00527a601de70f6a7c0d670092a564d08e896fe2aed40ca2c1a91c94
SSDEEP

6144:9+RELVzhXkA3d8VZQvzwV2lms5JBpknvjXGXgcHM/18XKQJ:cRELVzhXkAN8VZQLfh5JBpknvjXGXgcp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
3412	msedge.exe
3412	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4392	identity_helper.exe
4392	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1116	3412	msedge.exe	83
PID 3412 wrote to memory of 1116	3412	msedge.exe	83
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 4732	3412	msedge.exe	85
PID 3412 wrote to memory of 4732	3412	msedge.exe	85
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\dfd3a4836338803d94395471ea488a2b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa046f46f8,0x7ffa046f4708,0x7ffa046f4718
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
71d54d23a9d8818cd769c2fd78a57c91

SHA1
b807062608567647fe4a68388eb298d95e982f4b

SHA256
ffcb16becf570b44475899e652c2ff5d9c895cc3bca54049690c2be0b0159eb9

SHA512
339a858c565b515d7b30d091db06b10d6187497f6f5d883276cc8fbade569b7f32fc15888e81e2c2c2a8a6456000cf3e227b8031623d98c912c0b32e20243dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
16df075e0b40cb827b4b34024d6135b2

SHA1
1443bd9f4511333081bafab23840a07e448dcf7e

SHA256
8d5baa793a7e538d38affafdc647680bf96cae3a21f4b44b27ef48bb3a209bb8

SHA512
240577e8ff97fe5d12aff804f63801a321e138bfdbc34abd4a93543d7a8fbb4a20c8094dc012ab5f118227b85d6262de094e8edc7b608a32c3a86de020d505bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
42fc9929aa3a81d6f37658937fdee428

SHA1
6a37a105212b69cc5648cc796e3286077ab0f9c7

SHA256
a344ec4ab0f9c4cdd61f11d71aafb2821b240e53b4496badab27082f84ad7517

SHA512
d3d1ae4f9752a82e5d297cf84c585eba68d9c5e944c46b677b02811cb67463541b35a847653755014da75f99f8beca97e65af740df970e9ebbffce653c2e75a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0ab8382300892db528816094a5056b6b

SHA1
d89f2373ac0502ae344a534e7cc5e37355c29378

SHA256
df49cf3c919217aec5aeca804ac918ffaf1ccbeecc1a1090f0c4642f70c8cd76

SHA512
b64fbf6df8d96212ddb2a94b364c2ec9e045f36e6f3ef71f8357e6de590ac4c2362747b98937d70a5c1307e50d0caa30a990ee52d06b8c0b0f15c32a828d3cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
42ddde6c2657419bc630cf8f4d0ef85f

SHA1
442336ee0456bbac69258552c79a108c288157d1

SHA256
9b2482643626dfa7afa0fbce719ecfac1673e9805a6c28ad6ad5b095d7a33a43

SHA512
66b1f952e3a04b4e13fcc33a0e6cacddfd14e0cf5608959aa20dabb523ba79eb898ed3ff8eb9824d25d915779d4c5d27a8be495f5a415978c032df2303630284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f66086061f2e3f7bab269deec74e439

SHA1
c66f91c8ec67a895e57974ea567402fe339c398e

SHA256
380265582e8608b27a3cb6b02781184725d1085380e8dccd1dc15c5070eec6ac

SHA512
fbb877089af4e3f4bf4c0cd6150fbe6206cc4f19cfb82c875d3e6f0db864b1449285143f5438c875765b07541d907603b78f5af8785d60dbb194c74ba2b7aa8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e985411f5dd769e6c2ac39c2d23b2345

SHA1
16c82dcf153589febdfb4311b295fa993f55e8c8

SHA256
2a84e95677bcf2ebeadea19c712f4074aecb9288b4256bbef4ac57c1de8b5943

SHA512
140c05f4a5685cbfe031c32a5a7033346cfab0cf07ba04d4b3daa587b9d389a478dbf7d02a5e5194a38ef22a59569538dc1e57265282eec6c7f206dba7181b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
e04887d86078964eeff2176880e4fb9c

SHA1
a4c08c6722ff30a3b8583f59ea1c575624466ded

SHA256
2d4359fe29e0e6e5824cdf1bd34d834d117118e81fbe402723cc05ee32a908a1

SHA512
334d410790f78bd5375b15f6237f67c4fab4b2bdf7dd3658b148856db9b11cf60a87e631b306449b74c8d81c42f882f9c88a14e02b563b62798d212beaa5cca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
86d32da776084944a87d12e3e8143ce7

SHA1
af858b12a6d0ae06e8080f86d68634e70f1a619c

SHA256
c8bb402ac3c6030e7a3a465418c675032bdc90ff8b3d4d12b773c16105e57caa

SHA512
0888a5e9668fcb1a50fa68e603800417824ec0f5d69fbb90f61f6b6e6e786b68016487bc4143238b7e64b9bfc6bc33c7bed9902a05cea9a68c8f1f115a35cac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583302.TMP

Filesize
204B

MD5
652376c9f028c5bb7dc6624d3380479d

SHA1
e137971a422b60cea036b5bbea9ef57d27cee96f

SHA256
3b34c9f336c9611dec680ed3f820af850b7adc17d51c21d5652e9bdce8ce5795

SHA512
5777061dbf06483e1705c5eecc714d1e91c94d6b1852c9ff89b6e737958003abb83267ce5c486e098fb9c77bd271964c4aae17d4f92dae07dd07602462bdd15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
56d4cd60e70279ac90bd4b37784d2e9f

SHA1
ca3c95de4f0cdb10e0f001967e410823d1429c95

SHA256
a8e1b8850c97463acc25109403272abb3fd363e2cbe70c72aaeb73242b1d77d4

SHA512
e2d639bd8b8cfc24796161a3ff9cd513c5d817bb77da4b39654f4c93e34b5a2b2a0ae1d15b9267110f0fa0439e0608dab23bee04bbf0cf36b4acc1092be23419

Download Submit