458f35f248a0bf443a9924b24229fbbac774c8300674e16c34554df4d8674321

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2297f57bc4e3fea78c4f616c0ed309b3_JaffaCakes118.html
Size

113KB
MD5

2297f57bc4e3fea78c4f616c0ed309b3
SHA1

67696314ae07db40ea49794a20f09ee4134a0ba7
SHA256

458f35f248a0bf443a9924b24229fbbac774c8300674e16c34554df4d8674321
SHA512

c5b11324200d9bf63b24c2b5fbce37a77cb10092ea0114f57846240901817c69d4ca1b7e1902041984c78cb1762c30725afa30ef28575406cdf0ae2981b52093
SSDEEP

1536:mhNxmSs8XNwQzJSgm1WpYkCBloHcifl9CBloalk0SUrlEll7wymePebexe9aeeE4:MNXTwQzj7L5qUUq2AZs7hbZAJIzXOU8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
4852	msedge.exe
4852	msedge.exe
3916	identity_helper.exe
3916	identity_helper.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2916	4852	msedge.exe	83
PID 4852 wrote to memory of 2916	4852	msedge.exe	83
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 1348	4852	msedge.exe	84
PID 4852 wrote to memory of 2088	4852	msedge.exe	85
PID 4852 wrote to memory of 2088	4852	msedge.exe	85
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86
PID 4852 wrote to memory of 3764	4852	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2297f57bc4e3fea78c4f616c0ed309b3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc28246f8,0x7ffbc2824708,0x7ffbc2824718
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9803539410433622943,7861345789667057894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
192B

MD5
9058c49bbb15068b3c7fe5d5a52adef2

SHA1
c927bccd38c1a0a237deaa7cc7de78b2f7da78d3

SHA256
d6e7b213e4aac7534aea683bfd105896e34d88e0b1047edd52539ea16107e54c

SHA512
90e35e717805ebc703d63845b0f6105c0f60ebe2be71c7c082963facf45d94151687483f10d21cceeea438ccd70e45603ef4d82975aae66debc977d5766c8c8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
cf5e04c9602f5e8f83081bb6238ca7b2

SHA1
089a8fa413a100f9c21ad2ba9efeb1fdadf5fd7a

SHA256
cc726545905af5523ea16f42e00931301c8ac33d0fd3447a060487a429dc99cb

SHA512
c55ded6616f56ae00ec84d646360eeabfe05936ffa4d460fa7978d1fc4f4eb4af815d05de7deb70ca8cd326ef0392bc0f0613d4b9a6042b4718f74482ab5a5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c53c7c059d422715cdaa97d8ea01f944

SHA1
13bd78f5ab054c707596d3531fdc5ebb91a5cdce

SHA256
74108dec48fb94d5fb4e057463a2d4664966cf85bbaf4e77ee75f81ef1c3268b

SHA512
056ae92267e4d1566fab7df7cac1ebe04b2482a717bfa752610a523bf6342be732fabc99f635aa6648e392d33238145f8dccc11cc4ea954e5c25c188e8faa7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
debf42b73a0317c05ac9dd8e5e6e7df6

SHA1
6e3d16bc3e6dbdbf683f0d1bc7e0ea7d35023422

SHA256
6914b33530554242fa3b68689b1d1b5b563c6d54aef941ef518687dca073751f

SHA512
27d256127434edef0a85f0fdc69fe9df077cf806936a5ef1011d341ee771ca4a17429dfc2e2375f62a2c98df062608bc8cf891e7e6443e6b2bbb487d9a4c2aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
861c99da285778b39e99530f0ab4bdee

SHA1
e528d55869b859d147059e327044bf3479d60a6e

SHA256
fae814979a8616789062788b7a06d2c12214d4683f3cc29e88e300219dc2abac

SHA512
5696c4db1d4d670dac358328f0774b32fdd931e08145542bf9ac7f428be263e4b02a0c8a1fac843a8b982b32e0d606dfc0203200bde59ba667e81fa830c33724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23ec28f581c7ae6b0d9eaf4db55cde15

SHA1
f5c833b083c50385f4efe300e258a936e68db576

SHA256
bfbdb57ba26e1d17b3107c63ace22ec18667175622ca595681bedaa150e41089

SHA512
8c8d8b5dd26c63465af1b356d56cf3c58e96c13f1ddbb3f9da26bf2490f058316193cb3c57bbdc7e687cd2602bda8d016c886cee76d445485cf0ba042e5088a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4ce911ee45b1da6329f428a73011b1cb

SHA1
4b6ffc974d0733616065a89c85270aeafb6050f8

SHA256
5e440513328486d3d83c9e68e24dc1a42d6736082fbf909eb4ecefafc53fe0c4

SHA512
83da6afc67032cfb3e0f99579cdfdaf93ccb8b8b72bb2758891469bb7c93a010a415d1db8b42cf6481d489a43e4d9ab5311a052fbbd679ecc682bcaa51aa30a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ae0f867485b926f7260e405da76fc6b7

SHA1
5a831aaf26c2d166291bd2be61563344c6fd459e

SHA256
788deebc214239a2a89b927252517554fa6ab5cf6084ff65f95b60a894d9be85

SHA512
8462c5f9038cee424629a3a183264997d3f0804c967b7bf2e47c43307592bd17f7377360a749f0c1d39c3a71d1afffae32762a72d3e1dc369b559d507bc0872a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0fc38cd7682cca31efb37fd903bfb101

SHA1
9f430125a4cc6e82ab5846d9eed56d08c5f4057f

SHA256
0468ed0440a7167ac0e1d2de4d7029d9a6d9e39c18fbf04703db3f0c96665f6a

SHA512
196e82dc78a4b40e0333afb3a0678e16fcd88778d10de537831f0a6c1bf029fa1893fcc0512047d578e01553ac919ecb99ba17b1915b11a978f8c999f19d7413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bbde.TMP

Filesize
204B

MD5
6a606594e186f5bb14bab20682769c22

SHA1
b8b3ccb0ec5e1fcb1e8da43091f1f97e5ea03de2

SHA256
94ff47a73c5e6cb88c75b8ec5f9a3205bf612f45a48bc47efa0430133aa6820f

SHA512
845dbc68e6d414c2279bd55784c744697986ddd4c438ade31c2f6c5007df5dbbd45a264ce7ea5e60e364308c7ef20d0923d08b16e8f8adc6e5030cedd36f9801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5190d559ee18b2c6c9a790d60bde65c9

SHA1
2ba57b74154cc395479c25c6967ee8c5e9ddf3a0

SHA256
96dcfa869b765743dc18b83af8dd6eb768e7c1a359449fa334fcec02746c78e2

SHA512
3e29553a3d2a953d6592ce9727440eecc4b58f35427223e77f413179e852befc07d3f7c8584913659b25dd52b79b4fab219f1829fd0716c095168afcd260b284

Download Submit