e77dbc378758a950a79ad227ab2b9919f24e4e9165f3d35ded5946ff6daa2f31

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3543911621391f8baba17368faf0c542_JaffaCakes118.html
Size

18KB
MD5

3543911621391f8baba17368faf0c542
SHA1

f8526956ab7832704e99004d13eca3b469a533b5
SHA256

e77dbc378758a950a79ad227ab2b9919f24e4e9165f3d35ded5946ff6daa2f31
SHA512

bbf9555936164fe3dc89df1ff0a1241a3e087bb9f8fd33f5111d0db1bedce61da3ddc1884db68c1e9b49bc5938be4e7789d37f6f5a64f44731ca1452e8d8d7c1
SSDEEP

384:SC+4kEWCy5pFxmKxEyDoQ21PXSv0QOgwTVQ77V71271Fjp:SCvkrpFxmKxEcoQP89i5iTjp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
1216	msedge.exe
1216	msedge.exe
2268	identity_helper.exe
2268	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 220	1216	msedge.exe	82
PID 1216 wrote to memory of 220	1216	msedge.exe	82
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 1236	1216	msedge.exe	83
PID 1216 wrote to memory of 4660	1216	msedge.exe	84
PID 1216 wrote to memory of 4660	1216	msedge.exe	84
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85
PID 1216 wrote to memory of 3320	1216	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3543911621391f8baba17368faf0c542_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bede46f8,0x7ff8bede4708,0x7ff8bede4718
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9424141792224368866,14679970147404399334,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
1d82948fec5de481815f6390eed8c70c

SHA1
0c2706647422d65069bb92b40519c9d5b092e0b9

SHA256
66e4466343828c2dfcd4fac9873a2a7dfd3d84076d62fadb829b20b3e3e09433

SHA512
8fad50c61f13762ba20b325dfe8e527f300d4b79372503a2959bce58e3f9234ddf1036b155edb9dc6ca9c8db97376b40f0e878a1e8949512e85fd56db7efa768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f78b88918a48893c704bbd7496570a00

SHA1
781b68178d6687a74526e02033591c31ce857461

SHA256
5200f96e463be8140ed9afc24c76d18848b66fd7658628aa8c2574d280010ecf

SHA512
9601f676717a18fbb42eb5ead8c7e7206ee294ad24f94606e39e5cc25181ab76fb4931bffe34d2de4c721d9f2fc3620c144ecdec58acf9ef3bab2b2a9acd0d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9821320d86ee88f07395b99c7df74dcf

SHA1
9f29e86ed319421175ab925ff86eff1444fe1f69

SHA256
9982360dbea1a44d0337b77a097ed46677e84cfea0f61b04e6cba7378bb5b659

SHA512
2a3f8453f87b3e4f84f3d747246676123016f035c5a404ac645a36ad833873a664cf69319bd4d1bbde7173cd95c26f819c5681b22e11af91d380bbcd246e346c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d705fc81526354fb5eaca160036b3ff7

SHA1
0b5ee3f0fa70b3054dd587e71e061f0403b52ed7

SHA256
707b8ca1c2050fbca9a36f099658d0204166de0ae0ecac20fd2f5f0d40173e80

SHA512
3a36b121810f4fe26d7b0e4fe1843a89e481a349bbac5eb111d5e04f5527bdd59add0176ba1be464b7e29176dcf1df68c603662ca56f656f4a8cebc09ad8aced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57ead4e5b1e869b23cf9504dd5aa23e0

SHA1
12b42ff555f7b43590f47ff409fed4ae38e37036

SHA256
0265efee1436add3bc3b90c5cfa0e74bbc1e1e09781cd106a9f8e08b30813849

SHA512
23e642cd4b75d740681af9d32a62875e45c7c191bf6bef754a174c25a8b24414f348f5e453f86c2a303ff8cc1ade240e58d39193a4867bf9a8c141fa8fa7da64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
39375600f909be01532a4376282736d8

SHA1
e838ee2a43cae665a18d7997decedef628473cb2

SHA256
97fe56555ae6deac5b196613df723c682bdfbbdd8b47324a3bbde21cc85f0939

SHA512
423bfcda9a58b93df229d7e4263e89e6bcda7efa5aa0af0d8ea76c8889746764167c9f3a03ed5fcd8fcd58c2df6f89180dfed100e53e85001c651fa6fc64a2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
245228a3f2bffdb138ef765b12d2cf9f

SHA1
064098395b34e03cc500321885badad155c81ec5

SHA256
05fcaa2181552dd95fe92d619a048f775a02120e9e1e79580ac6676137bbf760

SHA512
3fb5eada5c4b05f1f87710b82364b5209d603dac97f5683562ce2bfa9f76e77ab260ce686b50cceae2db39118191b3fe08ac5cb690560bbcf76c3fc70c48486c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
003a5d4a458ec4c79090ecfd06f7b430

SHA1
f102c1d4d92abea8fa0e2a965f297a1d9f84530c

SHA256
2162d05894dfa4349c8cb73b751c4966c8073afa1313ec5df0fab4c9aedafe47

SHA512
5cd5622dfb6613939aa4ec43212358ba1b86174fb3448267d06560072627e771151b4443645b8131b3c2bd566d420e3476e17cfcf453061c9bc85963f15fff1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
8f4e95db05c7bebe9f72fca3f2d8ea2c

SHA1
371907d0f828a57ffa7c30a8bb13751980608ef0

SHA256
ea7ea557fbccc4b7b127e99084fbadf54104a621b927ade5c9a2906fffc2ea29

SHA512
41ee05df8bc8c824667dad689d818bd993591eb7690010e2205f7848b4f01ab42b678b604913c7cdd33afee964643242ed4df706dbef98d89831359cf4dcc101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582863.TMP

Filesize
704B

MD5
e10d1250cb4115e3e0ebeafc1546da5e

SHA1
40ea27b647b7516ff0ef2705a406387e7266504a

SHA256
97056948e833679d3bc1f65f2e490e104d1d56d5fe327f5eb528042534abf592

SHA512
9fcaea754a192c62d35e82c9c3180e170e21efa113a356413e148e9157be3f2a930e6fb53a97638f255fc6b94ff039d176e77b0a34a9bca3524bf14527d7abf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2d622c19a0b4c6214d94f848da85cf0

SHA1
e30da0687a4529c189a46c2c81ec895b5a23b7bf

SHA256
048a798b673c18819feadd5e55a7a3a8e5037da3dde2f319b39aa9bd75ec06d8

SHA512
22621e1d263a8a7b06cb24f4b07689d36d4681d8815565dc265b60bb829d21134514e5c0ce8e8a617e8e01de1f0c5e5478f94bdafca15d74d429863048d85576

Download Submit