767dbc8b620de1b5d86dbba526d04660cd2fc7b125c01c1cd87d33feb9637de4

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2078cd82fdf48a6a25c0f694244d9a0a_JaffaCakes118.html
Size

69KB
MD5

2078cd82fdf48a6a25c0f694244d9a0a
SHA1

c21dd7402d5a51c366937f0de37fcf7a4be0279f
SHA256

767dbc8b620de1b5d86dbba526d04660cd2fc7b125c01c1cd87d33feb9637de4
SHA512

8cfbc159aed87f2fee5238361f9f00d251c9cca95994f4028119f24df11c7bf183967dd283fc07e76a58ba8ec5da34129feae5c8b4d47db5865a7ba915ed8b1c
SSDEEP

1536:vo//oGA5Cr/PtpCDQWGGu7ODVY/DUy6JCJJIBGjhv+abffxuhLRl6Y:vo//oG/pCD87uY56yeBGjhv+cxuhLRlF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
668	msedge.exe
668	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
400	identity_helper.exe
400	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 228	668	msedge.exe	84
PID 668 wrote to memory of 228	668	msedge.exe	84
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 468	668	msedge.exe	85
PID 668 wrote to memory of 1180	668	msedge.exe	86
PID 668 wrote to memory of 1180	668	msedge.exe	86
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87
PID 668 wrote to memory of 4452	668	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2078cd82fdf48a6a25c0f694244d9a0a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff848f846f8,0x7ff848f84708,0x7ff848f84718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3089401375386346773,8719931212505804603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
d215e4627de1209e95c52e792d4f2541

SHA1
b51773aeabfb9070ae29d49e48b70b0b6256baf3

SHA256
623a205ff4505085b78bab52fede2aef0c2416d9449e6dad9c7b0801e20affe1

SHA512
c9e2dcd4428f1718c2b4b01ad7d91c4c24f9c86e8e2d85cd5f617d126dce07e3554c4656826bb1dfb345689b3d76476f51d35931783badecc32173d50b3b96ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
82b7ecc41b439433e3d2184223588735

SHA1
7a73dc425670423b20f0a89fe1b643dbe102e2b9

SHA256
7e6b544451ceed461bd526db58d5482cf8b40ba0b8ba2fc98246df3e339addba

SHA512
b379c704c7201ad1045a809dd1c34c44432e7f27fcfdeb2f79a6683048742432db897a41f8962bc8540fed723b37e44ec7a68d276d4f93f9dd77c48a7096dea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9845308439d54e0798719cb427cc1b53

SHA1
a14d14083a06bf9d803773f4a849c6f415984b79

SHA256
eacc875d6dfb64ca8a6138b34d67f18e887914b57c1612511172995e51f891ad

SHA512
1f8fdd30e3d9c96ac4b99161e7d26c6d60766ff6a19f7ff477b73c50e063c292cd3053fe699ede5f8ac6744256b016a157ef4d8076ab594bdf77367fbd1609ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1bd4050dd29474b1e688c9464418a32

SHA1
f3cc1fd8dc7043c66bd0aa692c5db0104cfd6a27

SHA256
68a22b222fd58cbf4d58e69a9969276ce13b38d98df4c356e32d2f86819c0347

SHA512
429281a2197529792c7a19d160e5ba71d40b63ba876a089d427dcc4624c0260ae2953363d4fdc9969035af27229fc556c9aed965132e0acb7e4a8fc07ddcc4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
70b9c208fd6228859059fabb3ee419db

SHA1
a7d4f285e075110891610ae3a2a3de4ee14a95a2

SHA256
66dcf358ea8e1c745be8b2df2942fb6482da5883a73f88d58276dd1e4de06154

SHA512
4b886e66dd845fe615a112ba9dfdf621b183dbc3255bfb485405020880d9d443db8ce4642f832d8d0c0396cadf796fceab3e57c720277144679c1158eed1d300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4b748f6e9689a6de250c91487bf0c4ef

SHA1
68d641a33e5ac67456e46d2c0c9949ede47b111b

SHA256
b1417eee61a3edf7e6c2b412af6dd30c763c45b4f935ddbe6c2e668448efc1dc

SHA512
ad50d8807d552cdc19c57536c5918da9f85661688e525b9a97a77032a00d593982dfe2bdc4f0f159a1882cb50f3953884aa6595a81b8024981b169bedc3b9ffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aabf63f93730be4e21359a9781dbc4d8

SHA1
a8cde3913b72c0261903bd5cf95f4807efc140c2

SHA256
6a636e3988b9323fdd8c5346315621548164f0cde22bd042d39eb2dd3bd47ab2

SHA512
f3409c4a564abe6b47ba9b1aff02284040b58bb901d454fef571c0a9647760c2a9d6c889e1d7c01c2f37c8936a742f86aa89f474747c18a1e4795ccd1d8d45d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
698B

MD5
00d180b3bed83eadba50b813e5072016

SHA1
c3fef04b030e88a926b5cc3f96875a1b794167ef

SHA256
a8e31240fad70b1f9c12f4444bd145ae2ca07edefc85c6d1841be201c4675e8b

SHA512
79d2f9a99ed35e8a9c4af73ae0e9a0ba0a4994a85e56de496845be633ef0cad312c0357eaa148554f0d464ef68c9a32628f7173455814b9fd2e8eb1bafad95b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bedb.TMP

Filesize
532B

MD5
2114dcc4b45035e18b5c37f684a8114f

SHA1
795953b700cf01c024ac765e608eb9c6f2e04a69

SHA256
a24632d097711b1668a8723aa910a06e5b291a32021bd75990b0e6f47af0dd23

SHA512
05efec5db031682e643e07e704aaa2442686f343b968bf5d4dcecca0c38a4694d09399ec69cecaa0ce689477c005f4a2476566c03ff78ca1c70ad6969d694065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d3bc86be84a5e67549d6af00ed07ae2f

SHA1
25b3766dc5655b08d487e38bc157eeebc09dbd79

SHA256
a6c9e99b964e9b756b3b6b9b9d175fcd46213dbb9d41dff9b9f33a420360b11a

SHA512
a310a4252654c2c259e5be494f4847002938b368089390d96312676ee94dce43ea0736b88aeb49b03447c27f7fa539098cb0ffcff160e5661240687ae995b95f

Download Submit