c82d36298ee7a1a4a9cb750dc9c8f573f6a3b30e1a47f8bdc892a62ab166a06c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ee7446513b81597f0b453ebe7669536_JaffaCakes118.html
Size

297KB
MD5

3ee7446513b81597f0b453ebe7669536
SHA1

01a364803b19aac5663bfe5b98bade6f59b0f211
SHA256

c82d36298ee7a1a4a9cb750dc9c8f573f6a3b30e1a47f8bdc892a62ab166a06c
SHA512

a69e41bf826c9f6ac209d3c13720185d54e04ab7f419f99c93f8f5043a9e01a34ab3d628ebbd7d05d6c517f471b321324a17d0c9b7217db7ac52771508d7aa71
SSDEEP

1536:uD+SbTTF1SjT8HNkltM/jVII3IbIre0NV2m76oa0JLnvmee4dc8309dE6ORmqBot:s+SbTTFnHItCVI2vAwcDiTCH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
4824	msedge.exe
4824	msedge.exe
3804	identity_helper.exe
3804	identity_helper.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4820	4824	msedge.exe	82
PID 4824 wrote to memory of 4820	4824	msedge.exe	82
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3404	4824	msedge.exe	83
PID 4824 wrote to memory of 3224	4824	msedge.exe	84
PID 4824 wrote to memory of 3224	4824	msedge.exe	84
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85
PID 4824 wrote to memory of 4596	4824	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ee7446513b81597f0b453ebe7669536_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc002046f8,0x7ffc00204708,0x7ffc00204718
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3292482636303051856,272846452124043203,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8b1d2de90ec199078d186caf06db9bd2

SHA1
b825142a6b21778ec98e3d0a8a9e1377ad830416

SHA256
fd307750e19c83c30ba8b6d4806df7406c28228341893bb96423592b4e925ba5

SHA512
f5cf22066451b354e01ee38ab2fb824fc8eaabb7507e9abfa770dc9d71a8be819c89b807c72ada15e91a6554dd28a4ad0fbe7a6be23197cd663735971ecc71d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9d9a231dcc93d6bb1e6c633cd26c4016

SHA1
76ff98556c2914c7e8f15619b53639b1eadb0814

SHA256
19f4af6c4b13e00764bd1054bc84a497beb72bc435e55ce7cb27eb80d7532051

SHA512
ecc12664ab86f133b744b68cba8dae197af288672a3ed8e977c229968229fa03decfda6585db95cea224a890ef70ccc4af56607468999f23fa850d3fc3d1cae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
20f745606fc295e28f2fa1280076b1aa

SHA1
4e7e6c90a6c629aea4e2af76de23de481bed3314

SHA256
1d1a70f6efef469fb2d2e37fabf2fe4f65352be3a99c8b8f4c2de26127aa61b9

SHA512
2c06e52cf72fa945770c9fc6e41e9de64dce30daf4350e7f7661a27807cd8c65938734c77d1ba87f1be4036f1ff648449fb54ae2cdf596116c168d6ac106becb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f991881a6d18843cfeb1810ad7b94d6

SHA1
c894b34c4a41921b4d31b85ec8928378bcfb2b4f

SHA256
a291b3b0b32e24da087e185ab5db7e7ea09249b6b5fbe3d6b51481323d476962

SHA512
3d77a93ee6ad02e0ebf40ca7cab99ba68cfcfc42a85438b3ed7307d986f3c6dc7dd1f7142c1817f11ad63baa1bffe00cfba38c646b66d4648311cdf1a43f3f90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3786facb3b1b0efe780beac117496ede

SHA1
b81abc86f6f1917f6a0da7b4bc890d5dd2c8b4c3

SHA256
9796101c0854b17a8d2f3a7794d3994abb107cb891d8233608fecd0a67c198dd

SHA512
c98556e894fb61dac9abfc724c361f725eb948050ea483b2c3b9d161d0129b0c2cdadb328b34e6210de81a958fb2af7173678c6be87dfe342544c5a1ce3f2d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4018702edede939274f9f5adb5762738

SHA1
8d72eb1deba88ed05fc8536902248a0ad85b0b9d

SHA256
b1d8fd58166ceef823b0200426cd55580fc280588d84e94719ddd51dea7fde42

SHA512
15e60df9a64fba5e00ab9332623f82ec0a0fc89dba03dc3ec477701859b06e0e3ac026d0ce7d8c40abcd99a968fd337768e3603c668382de230e92728126c974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05317dec8a3af5220207e3803b879b87

SHA1
5bf6b80768cd3288a11ac7b703f366217163aacc

SHA256
2aefa52ea97a9f74a7a8e3ef4b671df181543511f2797ca942796f6bbfd599cf

SHA512
01b8c6870d6374db46092447cf63be6c1de96c073fc945cb5d731c50ae17a60e8c81af4bc0edbdfe6af4a7aab23c8fce157ea67084c3be0cac8722d7d02888a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
214d8d505387a833caa30c06ae07b144

SHA1
6aa20996ce201db108e1a02a2872b2ffddd06ae7

SHA256
a3d1b41d9d05e36a5d7e72767af2d607b36cd51cdf455c4eaee0f6177bc87c98

SHA512
e2da00a1132ab04f32c1cabe4c1de2c2f5a001b5b3b1c00781b5bed008bdb1d0d7bf6490304bf5f57e4ddf2b922b4df11a0c433812e57fd52d991bf7c97d4bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d7f1.TMP

Filesize
203B

MD5
528214ae9893fa4e3fc037910fabc4a5

SHA1
c2f6d04418d7b7f6fdbc14fde7f8703a9f5a3250

SHA256
bbc622deafda261203bb7e922604f9f4fe7fb72419168a8ad7f2c03ca2edcc1d

SHA512
981a536107aad145549d53c669088fc953802fb14e4831cab160842ca5f919fb4a0462517ea49c00f2d106536d0367cc7887a7f77f47a9fd90039dc94a929cd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ecdab36772773e19cfc3aae778ecfd1

SHA1
8ac620189655278cf94efe5256220e4803722d38

SHA256
5664ab53fafd98d787480a00fcf1684eefb208b40b49fe34ca04531f2b9f3f62

SHA512
3b640d875a16b1308742f99f616b094c8643ca36a1398507dbd1409fc671f93a32df0fb2809e4b8f4c3cf03e83e47ca54a0c8376a8864b1f9f375c73928800b1

Download Submit