47956b17e067fd0af5cfb8220b1ec82ff8ead787aa5bef655af3148ee8242b45

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f92c24d32634e84996ee51e51928cbc9_JaffaCakes118.html
Size

152KB
MD5

f92c24d32634e84996ee51e51928cbc9
SHA1

1373c6eeb32dbffc655b80514c98f1dc95be68c1
SHA256

47956b17e067fd0af5cfb8220b1ec82ff8ead787aa5bef655af3148ee8242b45
SHA512

9b49596f9cee691fa26b1b52031141f3becff83d4eb14a7441d6283a46aee7e95290f271549ee88e8633c4f747617e0bc765828f54661f109f2e4fb8e6fbc248
SSDEEP

3072:lF+SR3Bsza5krCO0/V/8rnOL55ShutTy9Msyw38fU7ienQpfQLPya+KIstwIA3Z7:jP75krCO0/V/8rnOL55ShutTU38fU7i5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
628	msedge.exe
628	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
2796	identity_helper.exe
2796	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3420	628	msedge.exe	87
PID 628 wrote to memory of 3420	628	msedge.exe	87
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 2580	628	msedge.exe	89
PID 628 wrote to memory of 4848	628	msedge.exe	90
PID 628 wrote to memory of 4848	628	msedge.exe	90
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91
PID 628 wrote to memory of 2640	628	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f92c24d32634e84996ee51e51928cbc9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c86a46f8,0x7ff9c86a4708,0x7ff9c86a4718
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14367793598500917551,1580917441099342632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
22KB

MD5
5ee0252e2decbc463a6836b4644944cf

SHA1
ece04be6904d2fa53f47a5ce4441cede7e672530

SHA256
2d923fec0cef8f8685631958275c13e0228113cd9c3abaf8d78b73299b5e1908

SHA512
c242aeb360f88bd727075353e4fea4c086df02e3f6bfd8f938cebd85ebb72bfa31a46f5626b3c8a75f6d99ce616b6373f4fc6d98d538fb46059bc70423cefab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
bb8212eef01be919e0a1cb9b939b7af7

SHA1
a8be1ae11ad3b724c5aa97a5bce99d1bf6d20d53

SHA256
1ef93ac8deef84a2eb622e8d02226d91927930e00df2676a3ac36c9d4978acce

SHA512
5cf07770fb2b9b1eec699e6271048e7fa401d0c96b1532edb926d18a7e4978018f932eeee996f76aa9ec4a36f6809fdb830831cb7bdcb1b2fb2fb7a18c8aa2d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
3a437347ab698a1cb6c1fce549b5d9ab

SHA1
0ae18ae7be9fc28bbb6bc431476497297889a7c2

SHA256
5c476221fd4d80fe5887f076e163488d751e7ed7b5b9f567a4c9333b51c2f9ec

SHA512
3ecaad9a0f72bf6f790cca135275769dd7ba1971cc29235910c6a299d2dff916e91f34f62983cc81ed8424d583e46ec44165fe9d1ab762797879fba144717ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c8d211fd443e3d01b94139c1fb93ce73

SHA1
0ec4e6720248db3867dbdfe8339ff01deaa6acfe

SHA256
646692f3167ffd9d6c75f08e1dd1142dd1e7951ce906a95dc67c1d67b40fe8ae

SHA512
3fcbac0d4c0788dd68e87d5a511f54d179a7dcc4265177d57b866b159cc828c0946d484c5fe50a009362818718b236346d720423a8e38349decdb7f756a4e5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99ed9f262ea1ffdf7c831b5b3f1c2817

SHA1
51966c13fe6bf3a3e382d735864ce23b2e330320

SHA256
7848698d23eae896efea1f5e8d0440b712caa2d6a9a92a410e9b71cf81a41a31

SHA512
d2ccae3a2da227ceef27626e279f4396ac8b637bcca403705bc3fd165b977eb50e30a6c85a540304f9909a3f2a0664fbb953174c7ba5f5fd9d191ce01ea51ff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca59c0a8993ae45223fbad2bd300a039

SHA1
f7e00a1dc8e744f10cc22a2e5ea22e3f24ef5f33

SHA256
acbd2be048b8264dbe887b71d252b08eb19024f7c7b35a019626e5b795cba24a

SHA512
533ea1e4516274777a9e459418146901542c0858ca2271b9001715ed60be03b1fe25eca80ac4d9d6ee9729fb7d51dded9f3567941e1b84d0342e8b42936606b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b9e92eea3e3ca4f7aaf9ed642252337

SHA1
21826b9478ae8d045792272cc187b9cba3cc827c

SHA256
fd75ada8faf72f47d7a7a6248bcbc18a8575e7af35a57a7a6fc654b6e797b5c2

SHA512
205273455217949bfadaf48ba96c18473fddc0dd9c19906b5b6a9b3db2bb97f7bd1e4253e0d7ed100bab20583f530dd3fcafed44a47304fa3a3372b5597663a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88dd2c4c3be322c23b8d079db325af80

SHA1
dd3c6b89716c396a84f155e4c8fbf6a57d0a46c8

SHA256
d8c2d2292f66f29cc3f9905d255950feeef8b985cbf6c935ee18d4e8bbfdae5f

SHA512
73031ee6cce4d56b067f3f4f23cf6a400d06826f32fd47ed93b1eaa30da438bf54228ca1a65e52c742d67337b0525f0a4bcd266d9586b5096cf8135bd21fb46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
052316ca991e8b9e6e814cdb35fccb9b

SHA1
1ae7e03e2cf0c7ae8ad2fc2c4c15e2f0901eae83

SHA256
55b81d71484d3d557ae9a46f74f9d8a7c67e5e055ba110177be12585ad87473d

SHA512
2a7c5cb3ea4be0818c22aaf06353b646f431b654f60522eb0d0746ad71976c7056718f73d24c2909c26ff7089406bd8176ba324e42cf2aa6bcae5869e8d0f52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591449.TMP

Filesize
370B

MD5
3ce2f7b9e0a2545fa7baa51dce38a1e2

SHA1
c9f4ea6f87fc634d9831eadf97a39a4ff1dc73b4

SHA256
e85bcad2ee1d71a8fea13d1e4d075928a6c648ea4d8a997b686749f5b1957281

SHA512
068a5bf2c014bd18a03a0437c0b1d17b247f5a2537d77caaaace70ece0a99a5769436aeda756db2f2ab163003841515ba05a6ed12473bf4530982219f8f2190d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa3f0a214e64b4330fa570f60d520501

SHA1
f4b4703edb71696ba2fda398618c10627c43aa33

SHA256
4d1a0dda581816b77093335195aeddb7102e534fa0888b037f3e2ba7ee30b97f

SHA512
7579928b464e007a6287f23f038cce7bce2094653d45dcffe0374aaec82c1fb2b84788471443c6101e5c0c278e64fa4039e2431a648df748ed16c8ec99373629

Download Submit