0f6b43d882921147adc3e3dafbdd2679a1b9c94db7f1698e64d338b3acfb37cc

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f09679c8f3ae5987ed1644a819926cc_JaffaCakes118.html
Size

125KB
MD5

3f09679c8f3ae5987ed1644a819926cc
SHA1

125cafc88f6ba92362823bca1d3bf424594e23ef
SHA256

0f6b43d882921147adc3e3dafbdd2679a1b9c94db7f1698e64d338b3acfb37cc
SHA512

1e5ecb9a59acc781620d408e169f81b7369c0ae2fabb1ce4d70e94298c7523eabd8532fb69f67553ee4b71232e06b37ceeaa5a17369a4bbbb35163626d31ea05
SSDEEP

1536:vjOTS/VLzwj29CxqTiBoilLjsdcbulEJ0A0q3MQ:vjOS/5zwj29Cxq2JlLjsdOUEiA93h

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
3712	msedge.exe
3712	msedge.exe
4712	identity_helper.exe
4712	identity_helper.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 5064	3712	msedge.exe	82
PID 3712 wrote to memory of 5064	3712	msedge.exe	82
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 880	3712	msedge.exe	83
PID 3712 wrote to memory of 4228	3712	msedge.exe	84
PID 3712 wrote to memory of 4228	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85
PID 3712 wrote to memory of 412	3712	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3f09679c8f3ae5987ed1644a819926cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9272c46f8,0x7ff9272c4708,0x7ff9272c4718
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3247161763926841122,594392673171812104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8178e5b56814830c720b62945509f17d

SHA1
9b6ade9702750f65740a9afdceae730b9757f46b

SHA256
ae3414747c53256c43a98de903eef90e408606a407ea03d76182aea25c753858

SHA512
b5bbd729b7e558b466c7edeba2f98e9af8dd15da9b809c9a2c5ecd7d51f277e6808db2aafbeda339a660d69604848a17c3b70f7e5a0bfdc236e1e18d13e25760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
b5785e8432b476b482b683c51432f98d

SHA1
9ff963013eca0ddf5b5170101dc3c5788a12be36

SHA256
2ad9cbd8d71a4441877cb477b37e70c42bfd10c926fe470ed4e9c6368b6260d0

SHA512
f95f68c2899c545de260d47e3749a565ad5c00b5ad857cf29075d49368e5ce123481a5156a0dc98341389d3616ab4a1969dad101e9ce5af18f378bc33e759ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
39cd3343bd5ac71471658e2b3771360f

SHA1
67a7a409ce0c080e5254d493e0b351a87bd97d4d

SHA256
ef36beac3abc58d0dc4c77fb4f586055a72680977bf6ce8d52e8907139e8b57a

SHA512
2a73431859e120076c42143be5c7f12850d931e2bfb22e1e3d73841539530a0e94d5bf65f7a94ee056c54f2b8d393369ac0fcbd53b1badb3456a98f3bba21ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b72935005441524af203bf1450441d7

SHA1
2d32eaed7f6b14886d3ad31ea78f3637d89e5a55

SHA256
5321dc1c2d7bf9bd464e5d08957e612c0f8607518ece3945f1887a01f2383b5a

SHA512
f57facc61a182a1b738c6c65fae5eb741d71567d0ce28b42b5bbf87d7e05c5f68de22ff693c591b4cf2a36d058dcd9d78accd03e94ab427759bdfecbcf861a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea5705ae5570e6f718353407af989cce

SHA1
c6f3803c1b8f839bfa1925eaafb4806860ac3954

SHA256
04639ff52af51ca8643d0ca18be92ac240c3f560d71351bb144e9e70ff4073b8

SHA512
73100d18de80f9f345cb9ecf5cf1a0dadaf3a586e9de7e05d858df90936b9b6da8fca5904184087dd72089744d1728acdce4f4c294bd56bbd2a574bd87732fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
904db7c0af09fe1ecb52b3f040796ba5

SHA1
6ad898a2287d849f0676efdeb2bac8ad76790399

SHA256
e2a85360e0820af7057c83bc0a5aebf9dec34bb44368faabc45979577dfd9ab1

SHA512
cb9e7a7373254a581cb1477242d80a308c77c179859f17b0ce6ab4619bbb6ad24c606cd44a9c8c5f47f2d1b763b444f7847f66dd5ce408657fd4b872ef8c4b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99be935c948fa99fff90b96526e75abd

SHA1
8690685a20ee00c708f7fd4f056f98dd936f18d4

SHA256
c079bffef2f1f3bd9c041fd9be5302bbdbf5a41f9ef137b559af842697692671

SHA512
0b77945795b3ef09f796e127c50a1ac951d5c03142f8f2971d23957c137c0061778929a3e31025e6487c2a67864f5917a3a830570eae142d177c087a2720b05c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
07bc106e6a694017fd7907e0d08e04ec

SHA1
e7ffee644a70bb5a2ed35805db2604d9735baeb7

SHA256
939d699944c413019ae5aecc23ecc73ee50069df9f749d713b2e63960c7c8093

SHA512
81917d7379b59ddf9dd67558dc0446cd6d79d7a91a7d184265fb23b16ab9d501bd91d25773ca26595d0af956d269e6cd35b015b94c05db80aafb3f9b9b2e7733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e59d.TMP

Filesize
370B

MD5
8cd283a77f0ca0c2303db827a2cdb11b

SHA1
f388ea11b07d4e3702eec64ccf583b355260b346

SHA256
50a194da7d5cfdc7e008b0bdfca84bf0a3ff88636363517c93561273413eb947

SHA512
cdb7b604d025db5f9d890dd5a67745fd9ced7b7560c6f4ae673c3042fec46255d31bade24007b12bb7c5d77cb9b25ab71a75ae287356d2b4a16e099492e4b412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0aa76d0a1d2041cf4ac25b4876813e8c

SHA1
0e29faee480e0804a41493c419a956a90ea58363

SHA256
daf92f61e2566b94393de321e51e59479f3b4e66573e65d99a75613514586e24

SHA512
d12697eda27aa95eda0707417c7101eb04332257b5320cf0c2e851a8fa860657c2490012550ed02f23b731c01c51f0d6c827bce1eebe6dcb8db0cd3cb7220a26

Download Submit