716e4d2bde4865792bd202154aac75cc2aa84814f9f30b3cb4138a0ef4dc02e2

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e88abe2d3104a1d392d4acbe4656838_JaffaCakes118.html
Size

68KB
MD5

3e88abe2d3104a1d392d4acbe4656838
SHA1

47a92906556ed30928642ece4071edd3829093db
SHA256

716e4d2bde4865792bd202154aac75cc2aa84814f9f30b3cb4138a0ef4dc02e2
SHA512

d1a13d46c18ce4dfdc521bcb7ba46ce015aa4dbf89c7a4aea3c5223aac2bea2ea4595cbb236b8f8aae6a8b4d9a6588ce1d37501bcb143628c66d11d774d71e3d
SSDEEP

1536:PG89paiDgC2QTAFZtg2MgGRadncbAqZaXu8X9he:PG89palXtjMgGRaZctZaN9he

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
2232	msedge.exe
2232	msedge.exe
1696	identity_helper.exe
1696	identity_helper.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2092	2232	msedge.exe	81
PID 2232 wrote to memory of 2092	2232	msedge.exe	81
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 4192	2232	msedge.exe	82
PID 2232 wrote to memory of 1940	2232	msedge.exe	83
PID 2232 wrote to memory of 1940	2232	msedge.exe	83
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84
PID 2232 wrote to memory of 3784	2232	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3e88abe2d3104a1d392d4acbe4656838_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe80df46f8,0x7ffe80df4708,0x7ffe80df4718
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,3645031788242851692,11120001189639884308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
beb5e6a704825f4569e9b2d346ab5075

SHA1
ca67cc81666e8a22918dce0bd61b019593b565c6

SHA256
f3e676734c2b0ab402fdd8fe31a28e647e111b4dc55957d151be1283d0e25f4b

SHA512
761105a72ba6da0cdec9bcf4609ad7bb2cd8746059d44ca49958a30a527d208f5a03b9a375a1225ff1afefdd08b24c76c9fb42f80302c9d3af5d6a53b404f493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b1c4560eac1c07e12ee4651bfd9e5fce

SHA1
b2ad9a5789e2f61cb06acdb7d329503f1bc73270

SHA256
9cb65ad15edb7b92abeb4b842d5f90bd7404b98a120f159115ae92a2bdb87632

SHA512
4b4ba8db96ed500556b465efaaa7341b6df8f9ca05e04f8ed60df6d568de509c17bd59755593859b6fb42b752cc8ef29dd4d091c5fdb9ba86fef4cea97535a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2848ccc0f6c6c874a219e62810027ace

SHA1
9f98288b3eb3c0800188fa9c461931d157bf9738

SHA256
115218059833583e06b136464d4b4c77379ef31bad478a7a90b62efbabee1b1b

SHA512
16b88ffe3db42419ec8f4cfd7f0f0c7123a062362c9378d8b990427783fc2b9220897d403c3208788dbdeb1182f7896c564f7e5932ceb470ad7cd14c974ad14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6e50413bd107b9f9c288bbf3f1ec1034

SHA1
3fd8a579690a11a85c4ecf061b4deaedf1dda736

SHA256
1d936a3e30d9c63748f00fe2dbf650686a5034f8a67878b09654a97e49dade7e

SHA512
8d1cca3cd105f26ce0a21f0a27bdbac7a702bfdbefd26ad5c48b5d525a9f5283ea92f399f549e5f326f4fbf1e35c11419e76eb73d1002ec213d771a322de6266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5a608f24b2a3178dfd646c9ec6be72b

SHA1
748e63d0a7774de7b57fe3edad2f4727370f98ea

SHA256
f1ea6950f4f2a4054852687280fc9121b275f2a6d535f38564e9e89099de060b

SHA512
47863a1805f44fde7823d2e28c44a7c99b959080535f99b1353b66bd3f94907745748298a0003b4a909976b1bbd530a0f7c18926e59aa432096148b9e3516f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3185455d60e157c089c28cff54ece0a

SHA1
e4ed1d9754330eaa1ae0bc4e97ed6483395f353d

SHA256
39b72ccfbd5b3ab82bb4109a339722729516234d171e407f544f93655851da78

SHA512
421c79ac36ee38cd906873f1010c91d1bc1a7fd35d2395e4e4af846dc4dc96e1e4cf0b575083fce2e740baee5bcbe3c9aeb76c6f1d9913f95472903450a11109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2b52407505b51ddb2ae927a20416140

SHA1
7574933010e3b4769c5eb10a13342c074af3e6c3

SHA256
f0d5f015453a6a5490fbe8e9d2c4c96e221a7339a7ae7a032f59bdd11140936d

SHA512
d25ba822e50e288ba940bf6ff44e5ce443130d0a848bbd6d91ae7bb89add910f8a4cd0dc26ea01e381dd67c77dbab6246f5e2338d5330fe8f61c7265f72820f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ac4ed02cd16c290558cfd785b36e12c8

SHA1
3f26593c0dc2d16b947a3e4f98287c5c2450bcd2

SHA256
b0c08fa9b996481e20279067bd7927b2cb9686923f32292ab33d7bc65b99253a

SHA512
f5b1c7f0d897f661234e6230f489cc2a7d36646a6a4e045ee4f16a1dbb965e113941f4eaeb820664b39efb4521e8298b988dac9aabc03ba750ee537eb060ef8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584476.TMP

Filesize
1KB

MD5
acdaba157259940579c039dd7eaab4ec

SHA1
1a288e68c160a214bdf1c83bc5accc67eb08e80e

SHA256
f7ae59c2d129ca5924d0ac877ead2e24770f4f6ab09ec828e0467d6146eb4114

SHA512
8b2db2a67d0f94f8a22fb0c323e4096c37c13c177dad5ba33105080df99d04fb2b07b8e95fc1b7cc0988b2c3ac60b1633fa3c08eb9c36126e9b3564f3b018581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7006e56ec8adc6dff1479a5d327eb18d

SHA1
929ddcf9225cbb9d5edef4c077f6f6f9740f89db

SHA256
7b290abfb4326523eeb1928e6c1de7afa4c658c437097741ba7fc52407561154

SHA512
1b8f1435ae3fa6919f35fb261f7fbc535505c518f1750d8b3c358086b87d23f6cf1090b6371d9d422ecf3de071b2eb69d2ee38660c0f4ff8269b46bfec96afa2

Download Submit