1cb98fb7d273f743436d14dba9e8ec3704459bff5697f7d3829bf1725dba04c8

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24248070849f9d5998c5ceecb390e96b_JaffaCakes118.html
Size

176KB
MD5

24248070849f9d5998c5ceecb390e96b
SHA1

576c7edd4fca780db76c15ee71f21a080789fdfd
SHA256

1cb98fb7d273f743436d14dba9e8ec3704459bff5697f7d3829bf1725dba04c8
SHA512

a875cfc6a593208036b20bcdc6e5870721cfba11abafb77cd3c3c2a600448cfd557afb9806e68b823219cefaa461ff95c1dfd6dd317f4e0d60efd0ba1633b2de
SSDEEP

3072:fjWj9l5JHFjTpTawmLh7LGMIoKVuig+90aUzKFRgHF6daD:fjWFXNy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
828	msedge.exe
828	msedge.exe
5208	identity_helper.exe
5208	identity_helper.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1992	828	msedge.exe	85
PID 828 wrote to memory of 1992	828	msedge.exe	85
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 4432	828	msedge.exe	86
PID 828 wrote to memory of 1812	828	msedge.exe	87
PID 828 wrote to memory of 1812	828	msedge.exe	87
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88
PID 828 wrote to memory of 4920	828	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\24248070849f9d5998c5ceecb390e96b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb2cd46f8,0x7ffdb2cd4708,0x7ffdb2cd4718
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1207102385252465055,15143128619542815358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
052b0a834d133c0e585024d952bbb304

SHA1
225e85d79a2a0b4d8d37e2534f1eba69e57f6e00

SHA256
1d0ed3c4e56de229826cd536804b9ed3c4d68945d3e4db00b3c705e652d1e944

SHA512
78026c914bdb2f50be1f95102c90857e8cb999f545986bb7afcb1469c47b4b52316fe86089e43acfe6fb453da8b82580c872be2a639ea8d2f756b19ca7ee771d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
597137218d3c60ce8c1e99c2ebfcce95

SHA1
0e15c547a4fba58e92ba28f7f6ec291f67493408

SHA256
6496b90fce6eb3df1e1e4e2782b6a103c94c8bc3c536f5508b4d940bd932ef18

SHA512
056d3e7328959c55247950abb362f698dade708e7766f6dce842a4b7d3b220e224955e1156660bced2f5b53fb07437e26b373b01904673d13c4c6af847e9d60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
52a305f792e253e40c412b22aef12a74

SHA1
262eb59e7969ce58af3ac7f88045dfc47a210866

SHA256
493fa2c20fc27d2c4e66338fc4897556aa91285298d61aee63ae6f0a589ca10a

SHA512
196e8c6db854df173b82c15994d5b1f72683425252fb3c33b32162727b15bb64a04750c2603029203333d1b74bcf897ca677d221f1c79d413c34315243998b18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8d5b88999d6930fd7b2c3ae2134afa6

SHA1
ecb7533caadccb6cd5fc775fd8e74e4dd0930884

SHA256
38b4bcf9d73e68dd3c6064667a815f7feaa7e1e64de98cd7ed66e7df4c3281aa

SHA512
1a58ffcf3ec6b5ea02d3077ee9cfc500f11939ec6eccf4c3297b0dac77ad10cc9916879eeada801b32443b7c4fadb4152beb23618ed7cefbc72579f7c0420890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e1f9acbe47b3ab167ed6d32c6594e2d

SHA1
989912b08fda08fc2f9ac02113877834e7a8fe3f

SHA256
1589ab9f8e4bbfd72a3df17839b92f72f4c20fd1220ae195c5471550386b954e

SHA512
c9e57815ded3653a2065a9db4e336cc258ab10e0ac5d58de065050fb2b2663b01a30005c3aecb4dbc1c40889e15175a8f261880a8857f6368cf689f45d7c9c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b2d80aa1b00e43dd6cec3304239f19a8

SHA1
9d48b9ce739c4d33669a43e2420a2d705dd1839d

SHA256
87e996b36fbcb43c9e040d11e3cd6d7f2f20db25a07121c7eff280e28c7fc9e4

SHA512
0ab85c1537ed55579f1a6d7d34095a32176c063f8db4b68576168cb891b4cdf525d4a711a5f9560c40192aa172e1657ea78c4d8d8fdc4bf99bcb7fec96af2fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c3837cd76d52ccbe1554446b02666028

SHA1
1c91e546ec220205b47fc4d942ae1f8a97a891e3

SHA256
dd075a33d7d969eb36b309f3b413de510602433d4b034a9cf977fb73778308a3

SHA512
47f755bdd4a7b11d635219f59772287cb06e5f3861f4e071cbb5614462d3d66a751e490b3d8473a9498c40619f8379c699059108d286ccf2952df88e4a9a0b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
698B

MD5
27b88139bce541d471c9ea3be8312ea6

SHA1
b8d01275ab3b0a28e814fc98372aba7a57aa9885

SHA256
5e636fe85e80d4b3a8fbb1d7a591bee46b4321e25a7c01d56e2d3b5122ccaa54

SHA512
e1daddeac4a5cf169e24c8665fa9d3adb15c7a344b1b99f2a3becdf80d849c5ffa56ed2862996202131a3ba91c93b1cebd287ba1db140281307d2444f9a130ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
698B

MD5
a316b3facae00032b5fca8ca9ad6e665

SHA1
610a101bf6ded4d1693e978e6d339110f43de82f

SHA256
43346427149108dd8ec9a21dba7ac5a7a59fca0a0f8337c2cfd9e82a683b3293

SHA512
1497a6687b1f31599b81211a933f3560db9b136b8aa255b5675b8f711630461c3330437984b2edc5e4eedb3ef19d984d9ce1c2711a4c2675c1664b3026434e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579460.TMP

Filesize
698B

MD5
b2ef25345d9e22f5bbd1b84885ef4973

SHA1
88489fe057d8f97670b33b9b4e67bf3e9cb93eb1

SHA256
6415fc9a85871be86c8bdd0400d4e9f50a00c5576431e1d1e1fcac4a009448d4

SHA512
152c5e0b1cbfbd092c114499f8c69eaf6dfa402675ecd6b18e43b8d5f27152975dfed4d6ab08292c6edd63a7189f84a8820b0e11391c936ef7571a14c384de7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a469ca0c766fcfca7df603de4f041b5d

SHA1
8726484b521b05248205bfe53ca3eb52baf48753

SHA256
a115c161706783085e0e86567702b5c352e8c09b1a8a5193184e263699532dca

SHA512
ee59d7896f5fcbfb7af28f69870f0eb0e99f1caa8533015925053930392d1427acb3ba3d1998a247f0887e24708df548c4cdd900729033ea67cd1371e4f888c6

Download Submit