e0aae3e0201b3dfc8bbf07f8ee576184fcafcba531432e89cd8b38e3cbb379cb

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e78bf7a59aed4cf04f66b4245a7c4e83_JaffaCakes118.html
Size

71KB
MD5

e78bf7a59aed4cf04f66b4245a7c4e83
SHA1

c1546c27ec88bd86982a38f5e8d1c55f632aa332
SHA256

e0aae3e0201b3dfc8bbf07f8ee576184fcafcba531432e89cd8b38e3cbb379cb
SHA512

77736d001bea07976ccade895829141abaacd6bf8a75a084b82cd8841739ee34b11e6464f222e5b2150762dac056c98b4d4c08d3429a10a7079ea1dce29aca84
SSDEEP

1536:RTupBkrP5TVVuvUod/hOAVUZ2oSAZyt/gG:wpBkgvUod/hOAe3Hyt/gG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
1456	msedge.exe
1456	msedge.exe
960	identity_helper.exe
960	identity_helper.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2652	1456	msedge.exe	86
PID 1456 wrote to memory of 2652	1456	msedge.exe	86
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 1420	1456	msedge.exe	87
PID 1456 wrote to memory of 4816	1456	msedge.exe	88
PID 1456 wrote to memory of 4816	1456	msedge.exe	88
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89
PID 1456 wrote to memory of 3956	1456	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e78bf7a59aed4cf04f66b4245a7c4e83_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabd3146f8,0x7ffabd314708,0x7ffabd314718
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5182995200534427886,15337174696728387590,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d517a41-e695-4fbd-b5e1-65fbc0885bef.tmp

Filesize
11KB

MD5
f9b031aeabddb18cae8d406bd3182875

SHA1
2e946cb7917e0a592b26adbd6fc38eb14a9095d0

SHA256
bbc55d051e1a819c50dfccd672572b3faa723d46329e1c679bfd4d2e8432bde1

SHA512
24c632b39bea0a0c7a2a6d17e0ab150946ddf0ee10ae84cbe86bbcef0f6e7a5f52adf0e0dc6027b9ae6bddb8c20cac01c484c9cf687751199af5fa98942b8d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
22KB

MD5
79e675d72bdce45fbc43984cca5b1e11

SHA1
498bd777fdf8d09e6508262fbf04f2f7b4fa46b3

SHA256
60cc64beb4a9047b98408732d4ff65fbd4dfcc9430453436e72c3e0ab57d085f

SHA512
760c8fd2c43f6696b8f20f0e475d68c45a650566dc8bd8d719d4f64652c82b20f7cb37bde18af8c7a5226bb7c21faa0629119a8e46fa768a046a62ee290da889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5d4eabc3f274b8d8e7e2bee0f92e95bc

SHA1
fbc6b939965f83aae74f36e37018e130cd54f49a

SHA256
ef1c3cb1ccb38c918db1516a3b07caff5fca28adcc6b9ec0cf61226d1788a31f

SHA512
8d944458800b5637cf396bedc2f287e28909a514e1143b67f17555f7cccc3b6cf49c11a049c8793a74be88d4edbc75fe5c83cebb757c5a1f19a119b836232543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
10188e5f2c628dc9e106d3298fb77b0a

SHA1
7c396edfb1d6ea0177bb499cfa691101efa96244

SHA256
4714e95273d965b1520259ae04b6b04a9b12159976ab40b3b35ab5fb4fbf7915

SHA512
490d495bc40db92b8b78a3feeade28604bae6cdca5d0fcf5f3aef2b25a8aad2b62b76c4c494ade6a9e140ca2954d63f9d17a0c438ce917f1e79b1648407a982f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cce1666d2a80f3f2e712716fe6d7f1ba

SHA1
892c48997f277b8cfaa31977b6611b1a5bfe63c6

SHA256
c5c786f30de8661ac05ac1f3258f3b8fed31716a8f0888b7a782f80f396cd43a

SHA512
824f2207caeb1cceb6a050f39418eec1402c0dfd52e430aa6ec6fe130394b7de122d15eda155e1597f7ce679677e2c36ed73c7e48e58e87cae6264da80ccc2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
12ac4197d4abbb3244ca8fac06666db5

SHA1
eaa95a9147769301b436d928aa1d2a1d4591b613

SHA256
f9804ea182e75a01c5635f6515dbf8f6a444410ec82dae3e2ad890dd87ec26f8

SHA512
b6878f177b3f2ca74c38b90ceb3358315bd46b719245a5cebb21a3c58d5286c03693218a848cb472ed3d1e08c894466e225f2f20f6e97158961a290a59e29739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4be499c0f910e4bad768df171f995a7d

SHA1
6fffead25b36312c8eec69b0d6c7d5bd05ee4511

SHA256
f539d18a57aeb9c271672b00c55e7dbee8e5e48c5ad75039a1b4bcb9b3305bbc

SHA512
3b0902b31c6754fef86e6fc223a66933b20dde965198827f9510c6f1ee02353a453d8430ac7a0cc3c64bb09491ffe457ced886898a336f8e50430d35f3887dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
431552f46cbd27e1f312bd8fe6ccc0c7

SHA1
080f21bb019f9f563dc6f7186e202ebabe48300f

SHA256
b23efabd880d9aa1f2ee6a62c215d0cd989a32b56e624b69dc5f1bbd619273f5

SHA512
5bc764686eae3c5c8a93453f7481ce821ea44d3a18456303c7c6fb90c3d14b13d815d5d6420d08cac9533f17f3c78dd9ecd999229bd0603fcc2945d10a027525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
5b19016a2322499d6f57028ec81e4ed4

SHA1
7861c10b1716a73e9eeaa1826f0fe033daf6171f

SHA256
254454c2e56bde85602e41db420bea444d3f6efe8318b57faec74deab47fc8e2

SHA512
ab54bfb414d656a3f7fe1c542013000cf260f62334ca0091c1f398f7b283051cc8f089534f0ddd6460466f54a6ac8d825c24c13ec5a30c365fc1f0210bb0d882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c3bd.TMP

Filesize
372B

MD5
4fa66a68c7738bb41fdef8130724ba93

SHA1
7ece2ed40af1268fa9d4e00162bf42a6b972c65a

SHA256
bb301cfa504c5358b18eea14de0914f477c48c2d0cc6a64f01f1d27cf23bbd35

SHA512
f30be76791be0862f2000bf0b46e8bf3823e2f96cc8d6bfd528ca86d815cb56178778007bfee33aa16d6f3e0511c7cccdad4640c7865ea87857906837d7414f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit