e0535599241cf9f8ba099f087f62900a0fa42f12567d122f37791e04601b7787

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3bc890f4ebd27d9002ac6dbb9f37842_JaffaCakes118.html
Size

147KB
MD5

d3bc890f4ebd27d9002ac6dbb9f37842
SHA1

280d9e2c86ae983402b68041846a6abd3f4b4981
SHA256

e0535599241cf9f8ba099f087f62900a0fa42f12567d122f37791e04601b7787
SHA512

47bf319ef0b9bd40c32ff2503fda98b67b2dcd078e68edc999be851f1bd4be01862a2d1e7914dceb3656c1be5f356bf40495b25003847c315de669bcc38c2af1
SSDEEP

3072:44GONaxoDWfdORedcjox8uVnsDf4A9OmlF1/DqM4B5ASKnPEyWfeb/:44GOZidORedcjox8uVnsDf4A9OmlF1/P

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
724	msedge.exe
724	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 4488	724	msedge.exe	85
PID 724 wrote to memory of 4488	724	msedge.exe	85
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 3764	724	msedge.exe	86
PID 724 wrote to memory of 2680	724	msedge.exe	87
PID 724 wrote to memory of 2680	724	msedge.exe	87
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88
PID 724 wrote to memory of 5072	724	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d3bc890f4ebd27d9002ac6dbb9f37842_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe83646f8,0x7fffe8364708,0x7fffe8364718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14948395828705498714,18185916848093861218,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cd5629e-3286-4369-a801-3915a33929b1.tmp

Filesize
2KB

MD5
8fd19b9c43830a8416beaa30119f31d2

SHA1
eab8c626a9fff040e43d954ee6e084fcb1e6fefe

SHA256
085870b6d29fcf61bdbab663677e3ef75ff404a5ea18f4ab05fe0f95c1d66a6d

SHA512
0089ddc4b5487bb5cc64aaf6ff731e7e121794be5f43ed004c3c278cc75ff41e6afb0c6334b503ce4aa39cb6a482575b152251dcd888b0ff6d1473e1d52664e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c55088b5339cd7cf25087a9c7f05f654

SHA1
deaa0111557cfe15163c3ece0c2562371f328e8c

SHA256
89d4c3f563b5baae987168d0420c18d553d713af8b781679d87cdf08d499f2c4

SHA512
5408abf54374e3dd9628a92515f246a5e03d7b6f05a718bcfddc3f56331cd00796098537df7e821cb90db5dd0137df631bd62155ae02c3525073f70268158a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bc2859ac2d155d5e315c5688f7b70833

SHA1
bd48c4fe7ba2a06cb093e9364d17fd617e99e52d

SHA256
6cce72b01e10945614d17c7274d5e2f50176caeb019077ba976e2804d7f13598

SHA512
c038b528448be9764097a556abfc7486840f4cc0460d282eea34aac1a0693ffa8a71ec9d768babe6657d8ae3fbb8eacac22731fbef75e1145538f66feb6bcbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50a27858ca561756f526ed559f88f1a1

SHA1
43637cfd34204ffea3779be11a39ec7f30cbcb85

SHA256
62e02ad238873106961b32cf7530b331e2142421a36b63b775a6f30b88ab78fe

SHA512
053d939a01168ea5644ed7c3b438e2cb51d5362125bfc1269e1c1bc766690601ad8326c209eca5e4ea91af659576ecafe3688e50859e3697bfcf1a4cc35281e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa515f6a0d65448f2385e626561585da

SHA1
c6cb6ee404e7de2d152272aec297208e11bd5ed9

SHA256
ff0feebff5427ae5d08eee61c7f0c2cb13bda449063c60db099c4ad206132b81

SHA512
bb472b28d2b66097a694bd85b9ad19d3ac2394a4230c90838c59d1b3d7a67e7de92a824ae6fd8ce62929e3cd28620f8b1fa11a8b4fedc991d9fac9448add3604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1faf66bfe4324b5f81b43f4a7cc0f75d

SHA1
572ca52d16d05603e35c9618ee8b85a25b5151da

SHA256
f218c3a987593bd17536f795310fa718ec1f3279a3e9472a63851a1fe6118e6f

SHA512
9974274fd2af4fedaee83016dda2ecfe1e6b8b1dbe635e1a16109165ff069ed9b015d73d436d19205a6c30ab7ab8e906697f6c66a4739d02826986585e38576a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1bce0a621d503020fc4eae49b809f4c

SHA1
d3c4af44dcdfcf267cfff808bf88cfca773ce06a

SHA256
d4e68de8b21c7696dcad6af19fee057793e82f3a98d0b917cb6363ee1b4c4c8c

SHA512
53a9c139762ccb54690f1f9a1effc1752d5bea379e5f1dec9b32b7601897378bcb8f749b319a4ea9ecf36eec0f8a78528328fa043c5d8ef63c898ba19d79ef7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1426031fd8ebeabd5def59d0e5eb234a

SHA1
648fcd8d615afb8fcfb4a7428575f49d211d4a0f

SHA256
67e76198b750275907b05f1842686ed580aac98dccbd044da9ade9997fc7b430

SHA512
d9708c3b4c89202801592b6a054e0d827d96be4f5891734d27b44059f496d3e54e78991c1f1b73354243418c8f745a3d902e7e17ef9f1bf9d0a4f4a00404c848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c265.TMP

Filesize
1KB

MD5
bd5909e463f6a910585153bc55f464ff

SHA1
b23f50b13cd49b79d017cbef03eff1a4af213584

SHA256
9d64a8fe412f96333037b7e21339c7a37fb7b2a9e3d628daaf974ccc4821dd65

SHA512
bda34467c773a3c3a04351d2abd756ab70364db2ace6f2b6c11522576ec21a3501903c120cd78fb7fa1360b2b39f683b899407a1019a7bfc632069a1efbd39f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aafca0b2abe46154a065ebb6a92e5014

SHA1
e219a819e11eee84b7dccd0e5036ca0f9f6c720a

SHA256
77df830a593d068ec36f8ab9705a72cd32f86b429c099351048b8940ef6de311

SHA512
d7a00ddefad15ae2854a93a7f7677971954eef49257cdae9506ea1c24e9306bd745c7075dd7346b0ad128a253103f184e4412728857846a30628da481697c2fa

Download Submit