3c9519bc3028e593bba0bf5e3cfb3e143dd697a856c5c0e0ae80aa443bfe29ee

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

242523672a79aa01583cea164a3933bb_JaffaCakes118.html
Size

148KB
MD5

242523672a79aa01583cea164a3933bb
SHA1

d64be89535a2672be90fc64b63769ef104b0b310
SHA256

3c9519bc3028e593bba0bf5e3cfb3e143dd697a856c5c0e0ae80aa443bfe29ee
SHA512

732cd780c2d70855a38207e4382260498f8b5201cd4e00d815564c0c6b5393e460cf01e6a82efb6fb72634ab4ad65b56fb7c1dd7cb3761c2054a37546017b272
SSDEEP

3072:kB8nptrLcfu37p3L+sUrAd91MuwJqghNaI2GuFtc:kB8nptrLcfu37p3qCE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
3276	msedge.exe
3276	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
5568	msedge.exe
5568	msedge.exe
5568	msedge.exe
5568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2828	3276	msedge.exe	83
PID 3276 wrote to memory of 2828	3276	msedge.exe	83
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 3748	3276	msedge.exe	84
PID 3276 wrote to memory of 2200	3276	msedge.exe	85
PID 3276 wrote to memory of 2200	3276	msedge.exe	85
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86
PID 3276 wrote to memory of 1208	3276	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\242523672a79aa01583cea164a3933bb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffdf95b46f8,0x7ffdf95b4708,0x7ffdf95b4718
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,374967771710917792,15205258887769298716,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
bb252e03a5af605362faec7475dfbe6b

SHA1
949c502ae9e894a6ab7c13d59f2d72f694e0360d

SHA256
0d4a41ad06aefb4663cb3273d4683827f0a0648909bc5b6bb810e1ce62295ece

SHA512
8b38b9b84e0618fce9d4f327bf8c8f2265c34a18452e4c214e6b569ac8160173249c4f79de0714ef229916fd9fbe4c48539fc38c68813775510deb5ec0caa597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
69254366e6d5f65f4e7416210af9d59c

SHA1
937b1f051a803843fe005c489f47f670d317a33a

SHA256
64d013371bdc24d0d7124c9f9b6a70ae4d14a71f263742a32191625f8a606c65

SHA512
ff010f76143c88d238e76faa63b090174d79d2f41aa0925cc0510416c3cca3de9047cc1297e8f237f0e03e1fec90978879eb235957ac690305c774086d373749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7326c557736ac86e35668522329cfdac

SHA1
e258d988a9491abee87af24aac2bbccedb9ed783

SHA256
29cb4acf39173835067cb9cae1442e942baeda8ba5428415b00d364604653e3e

SHA512
f4ea4f9b1b4103fa3f926bfa16268510b27b44d380928c70ab0904b7defcf2f23549fe397e57fa77a8cbf20e262c3532e87a1fa357cb5493aca440cbe302b09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7a07d8a87be648b45a6cdee184b44874

SHA1
796efe4ef25d4939c6c4577615da80612a518148

SHA256
52438e2b867ee06358824bc494d2f23126e78f1fa6d08104f5316db76e8aa386

SHA512
2385886db95a143cdf53ef5c66a0bb7d5b88368a3a4d472b8b8cfb0b7f1a6557bf57cdba1260d4249d4196c844fbbe03dffefa1981b9df1f32dd91d5fa7bb905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2059f3858a388306bb959637488f13e9

SHA1
f92f55be3e7c6968ac2d3c8b44c233682f49aff0

SHA256
789dc544594a8a2a4f73e31e36bba425041dbbbfb495a7a8a67979a6f2a00bff

SHA512
2a13471bedd6b213cb57d2fdcf7766881f1b523243f527b92629855b073dfb077e000b3cb33cefd51a2fff83c05a42b86134b08abaff43f452ff08ee3e322a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f9561128118036c5d27737713f5edb8

SHA1
53b0c40a73bc364897d4d4353b06022c2d2ff4dc

SHA256
ca211508e33b9e7c4bb2c851286e70a20375c497d0de7e3ff682954f975f4c5e

SHA512
39878166bc7096b5a877ea16a2593dfb6dba737677825b8d2e4d08bd0ea82a659fd1fe1fe20cdd596b36b8409ba4f982e38041941863d16f5e28d3f145097e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
24f4bea68badc35d3a8bc33eee867df1

SHA1
4bb77305552af843ed77d3f2073d281260ff36a6

SHA256
867eb3d76f6b31c8b8e8ec7d86b846a29e4b53d54b576367fa6f49bd4f8e4669

SHA512
de5448af43245e5fa00f3ff9b1859b5ad4ebe0bc18f67b982f1957795ba73c0b9b5446d704b5f95d68c0e101157ff609de3bc6894f3134c3bb90afeea9feaa3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
77b67eb2629f94972d38148b7ee72fa9

SHA1
f9417b886d59dfa6e71819fb7edd7439e3c9b5a7

SHA256
06d1d51b90e3ea4008f6502ae6d4c765f4cf65b427121b6452197445839ffb38

SHA512
bc5d18aba649313d742931ac2e5dd50c4826b72f1a2dc48cfbf6502a5d00a07b4edba38a2adb1965b05ea82648f8a43c4467e749956446cbf26bb862b11309ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
21c56fb256a868ab8ba718ab0398ec7b

SHA1
627e733c495863d85a32b6e73dd5ecc83f7caa3c

SHA256
72f53d4f23abf10bde91281e0c364992c84c5e9e37c4aa942ba06ab67dcf6b4c

SHA512
a8b7cea2eeaf9f6ec7b8f058917a22f86b5f98eb5668a31c85a763418740d0fb35d2564d3e1731366868d21c34a742ff5a5c2d7908fdb2edd525aa97af5f2ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815a6.TMP

Filesize
203B

MD5
d568d83982cdf73c0c50974b8ea81f72

SHA1
c6101f0e7e2e91f2d982f1e8645d82fdd371e26c

SHA256
818b849aeee5ebaa122e5190268fa8142eca65147ac18efe183e879e1ac531a3

SHA512
5ca326ef13b011d7889a114e74826093503d184db047b1667cb5f8c81d95df7f572c7d739c47509bf729775764f2e20819f9113dcfb8b4aaac7b4c4fa8b533c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
57d429085f55a36e06a3cf3a3d8ddf52

SHA1
5f97904d93c1bd88d3382f885ed971d44a97ea54

SHA256
af642bb63b17431d3a7c3799b04a5639e3ce96e9e0c8db2e99b77f2fc4e64e8c

SHA512
8a2103063d845ce7d0dd1d1acf071900e19f603d842afb4d488de11b665b6304b31a70a155d4c83b0d6541b8f89bca02a07390a3ef5ad16d04d530d51febe7b5

Download Submit