c936dd298351d31ed4f498b44d02a97dd7609a3f9c28e26288bf3167f35ab987

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c791fac8e7e0f664cfb9816d4173021_JaffaCakes118.html
Size

113KB
MD5

0c791fac8e7e0f664cfb9816d4173021
SHA1

e6a1dad82c165aa4835aece3e0cdcbc76c56f5fd
SHA256

c936dd298351d31ed4f498b44d02a97dd7609a3f9c28e26288bf3167f35ab987
SHA512

61810c4116f5f0675c3b8d46a3b8e3858d479faa2dc3319d550662d42837ac64c4cb7caca12a644fda65c784b73990e0a713a9b37ba4520a66c3bfb886324452
SSDEEP

3072:fK5JvRSkUcjvG8rMUcXmNRSV4DVQnVD6MdSAGMHCt7S8:AZBGXmNR22qe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
3664	msedge.exe
3664	msedge.exe
2820	identity_helper.exe
2820	identity_helper.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3720	3664	msedge.exe	83
PID 3664 wrote to memory of 3720	3664	msedge.exe	83
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 2480	3664	msedge.exe	84
PID 3664 wrote to memory of 740	3664	msedge.exe	85
PID 3664 wrote to memory of 740	3664	msedge.exe	85
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86
PID 3664 wrote to memory of 660	3664	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c791fac8e7e0f664cfb9816d4173021_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff368d46f8,0x7fff368d4708,0x7fff368d4718
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,9186786462977742190,5146385341877027512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b93aba65028f8a6e40c0b64bb0403da8

SHA1
a5dac39f35dc5d8229320e3712a84632dbc8ce4e

SHA256
955e8edda840c388d4678e251de4e04c8df6e817573750f7e1962d26a76edb05

SHA512
5b37f34565583c1979143eba874e3845d220c9662e8e5b4fc5d81a9ea43d182e958bfeb15fb3993e6f732ab13af55c1c3b7cd7ef57301f70a6f93e9b408ab46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
302b5a04b5aebb0af815a9419d6af089

SHA1
64a2afa455b3a0bbfa50e409829d8a9eeead3225

SHA256
ac51c6e52374dcd1e0dfa22ffd384bc35515ebe07956c5287f88a046f1fa4d1b

SHA512
1afdd42d0f04dfea604862a766a38543fc05b1f3e50c933d1d1111ee562ddde854c8fbf679a833de31a4498ca413c0fad1dd2c67ca7f3fcc52c52440cf15abf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
69cbf9280f3299f7fa17f66814c04ad9

SHA1
8c35fdb00bc20470ed7685be35a92d7f39241857

SHA256
f9cb77e824a91e5945b61afe1b567b4dc4aae2f6baf830fc427da58bade438ae

SHA512
03d362c113910ff88639bfbac5a0ab91eb79df477774b051281c93bad1a2874f1b6effce80f3fc3d9b9dc0bea72ff48ce689adf554f906d53a12ed02ce5129c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68c64a80ef23092a17e25b41bcb43b9f

SHA1
07493b35c02b5d48ec28e82fc7fc4f6d57045c6d

SHA256
a5f1317c42271a33fdf9b2965dc9dfa0e6c8d8f8efe049c072a372b58bc0eca4

SHA512
056afe1778c0fee1037c5eecfb9331c4801dc5593b36879d072bdf076681876b782e90ced47ffa5516a255df8cea2224c0d3f157538c4e26e0dfd5ddf17a900e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
509934d1acf0d672378d9d22044e5322

SHA1
dd4a97cbdca6a59ca6de5983836e760c96a58a20

SHA256
2931cef8b5c3ed294be522489037d834f9492c292f1e912b1a221053fe7a3ceb

SHA512
554e159f1d49d65a3eb615b70ed7dc5fa4acfceac28acae5a497eab289862c065c3e1a3aae5e9bbf2271652d29097b608a05575cd7d35a4d24f7bc00ef7da75c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78e8c7f43fa51aa4fe1a3f07cc567dfe

SHA1
58cb8eb0ef4e9149eb74decfbe9c859fc4e48fdd

SHA256
c88a66f0efc5f711f1b8772d5e19249466571107baabc75147ed0284b8ede362

SHA512
7db11a54b78628cefa60e65d4f228871ad6c7bc138582dba85871899dd9138ce18f6666d864e717859ae6b73fcced28ce40eed535528e5698a290b0168ef1260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
53851cf089163b6f7818b1ef4f53a9d3

SHA1
28bd683eb95a3967753ab5f53e9fc0c4fef45c81

SHA256
bbefef507403f800c02b795d123119bf4c8c18ffcb3855dd41e5ade8b33e1299

SHA512
da7b058f82293cc02bd1cfa2d662072e600e66d99e513239316402c15ac6b7b6cc1fb3f94621eb899bc139bbba205a3129553f6e91b14fe5b7e7595c1fba17f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
698B

MD5
0427b98d355aba29ae5b18710b356605

SHA1
cc37f8e04261d7e17868221581c5a2a75e669e87

SHA256
f15494823642e068fffdf51bc85b03a6d76e660ef70a52bfaf92ccba0a33d3d2

SHA512
d7868656457723337be3286f5c5e85c3d6065cc4b5734f46d978cd537041edb447a74afc39195001e4ddc45246f44650903b06aeddccdc584a0bbb35fae5ca41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581681.TMP

Filesize
533B

MD5
49bba60c460e5d476d5d73dc67fe6529

SHA1
ae8f2e1dfec4cf5e71cc80ab08de59213b7fefd6

SHA256
0cf5faf2f6600ea6d455d1cc67dd477fec8a732bd69d5142822d430ba6ad43d8

SHA512
b68d42f9f7f91a70c8d90f491d21c5874e2e8109960961f5a77d59a083145e8556f3bdb8f103c0907609c321c84f59309fac464685e99f46761c1059b4c481bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f434e61ee3ac849067b7e464b20db74

SHA1
4914a3f90124b4e0e7ce535212c35f4eaaf9a290

SHA256
684ae2ebce1d0fd407389543d0f8d973dbd172862ed2767fd6530333b91c4694

SHA512
b1fde09a43d04247a8369a73a615191e70e0f4d53bb5e88678dcd656f1b0fca293f1853b1d52b5d3464eeee4ae293bdfe6125c4d9362af855e77373f857951d0

Download Submit