495fa79dfa41e92f9c5fd4d0027091a6de5806df6b5208af69b11b16fa420249

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4842ec9c545fcad9660d2617e5e25a21_JaffaCakes118.html
Size

32KB
MD5

4842ec9c545fcad9660d2617e5e25a21
SHA1

d80cbf05001ba267c6ec6192773d62c0111dd2c9
SHA256

495fa79dfa41e92f9c5fd4d0027091a6de5806df6b5208af69b11b16fa420249
SHA512

04826e3419a36ff959c228aaa75f626bc85ed674e11fe52252f41d2160c3770e1f75ec5de459f1dab81dbea0122f80fee74eddcacdfdff7baf2875d754ddd06b
SSDEEP

768:SCvktujBt/pFx9hRs9QbsStzJfcTOQA1DpQ48wpkaiTjp:SCJpFx9h7HrQEpQv7ai3p

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1424	msedge.exe
1424	msedge.exe
2844	identity_helper.exe
2844	identity_helper.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1256	1424	msedge.exe	84
PID 1424 wrote to memory of 1256	1424	msedge.exe	84
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 3740	1424	msedge.exe	85
PID 1424 wrote to memory of 1536	1424	msedge.exe	86
PID 1424 wrote to memory of 1536	1424	msedge.exe	86
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87
PID 1424 wrote to memory of 1344	1424	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4842ec9c545fcad9660d2617e5e25a21_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9603346f8,0x7ff960334708,0x7ff960334718
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14229501011728205988,11202610251074144047,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c785174ca453b44978a29fe56f3b5b09

SHA1
d59671489de82a569c3cf8d67086a933168107c0

SHA256
e1544528f6241e9989a5e2934664c893b558f0ba2cbdb00e618c9c43b2aad655

SHA512
fc8cfb7316b042461a712188b9a7de9b5f7b617980142cb463e41c341b2b242722f6362397ddab9c2ced65f8a4cd613955895b3b629665fc8dc61e743bc7a330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
a1d5eeb5d55be9225cabcc78d07c43dc

SHA1
3e5ac31c263ce01c235037ef35dafae183cd0977

SHA256
19eab6f9b89b2db422ac2f8223ca961601147836064f98cb856f2e3d13b85b18

SHA512
c3cfa47edc2157aee66f9d97a631dd33073bad4d2481e9b325130a4d56becf359479aee6927a4ddb1a91a9ff461062a1b4e2aa2bbf11ced62a422ccc6bc09ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
fbcc04591edb22c11d34df36045aa590

SHA1
13b379dfbb84b90b27921a26bfa2da30fe84e22f

SHA256
c89dae44f966f29dd822e542bca3c7cf41ba217590ca8505bba90336699ef525

SHA512
dd44e27c01d9145948d67f2c7e8e392df04c4276f60074e78c16c764335bc7b209ff905eff5ee25ae16fc230854a3747374edba25b26a0b7d1f5ec1c6f8d44b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6e6abfecdd0b703d6db4309f77d29c26

SHA1
69595883c026053e9e064c23e822cf06b197458a

SHA256
0188ed16fc45dbfaddd55544cc6fe5ff17e55ddcce1f036d271ff03edc1f0387

SHA512
baf66402d967f6f4c1285c8b6f3ba32794b30228be8a2aac49d7f005ee41eb677f0370f76c1b58eb1b09c6afa56371adab5490bad910b0dfe2dc42393e4c4d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aca7096b92559e2be7294aa732453838

SHA1
c82edb7025624022810ab6cb35b6cd7e988c856e

SHA256
199588772acf34b6b6fe6002993254c64daf1be9844c0312571166d9d54cf6d9

SHA512
4c55b3e6e40cf245b4d922b183b56925733d2765e78c7a26bdb8b74f69a8e883f2f8a013db6f0a0041e6be17562108b8b711182658698bed56e9f007f9e0a0f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cce127d48ce8a8edbb58d46db07bf741

SHA1
4e9200a581e7a87c73a646f96c8a1dc604c70ad4

SHA256
e1362a42970cc8570c4052cd56f204b89b40c306af4baa82beb4cf0a1b4d4d1e

SHA512
9f38a9aa1bf30bec79e56e0ae19d2efe8419bd8ccbc260d1f3bbe36672d030b152b1623b0f7be6e24a7504a70c10831aba966cc90c5a4ae26f7882188f345da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f4cab600279c46fb2371832bebb44ec

SHA1
c8146291f7faa71ea1b596009e4c906adde65930

SHA256
512c0a900c575c703a4baf152c44b5c6ac142161fdc1bdb240e8d926ad4e5b81

SHA512
2541998b9916b05a5ce22fcbfeb558b360ebb37bb5eac200bea66217fa4c627337d98720b0b4bbcf68760ffde24036082cfd4d3e4552c43fe79cd9046b272bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4ce41dec98ffe43eb24a735340864fc

SHA1
f2327f2220e244e04d6589f7c6c7ea5bf1082f43

SHA256
c94cbcde1e966615482a8d169ab2132890eb3997b93729f5415eaff65dca6a91

SHA512
659b85a364492d909b94cc30825236aa487ee530c0251b084538418feb53625227b470dd686f6e024a8e04c5ce60f4581e599d22fbbf3e96fc5bade549a39b41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
5be34f76c87065309036f8d3d04559ee

SHA1
256f36827984520ca676098e53a35822edc02a42

SHA256
f244175fecb8a584a282969b95e22cda3c7977c247a3468e8fc51257edc82ff6

SHA512
230d3b2fd3cc7205e0ce80df6d61c5a6cd8fef7ef1b6ce99e6f8046b7c80bf790d4380410d838eb7984ae38409a0d12225ac3fcdce983182951f66b94ecca8d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581894.TMP

Filesize
704B

MD5
88c0339d8b2ee31a313fbe53c698dd65

SHA1
0fa4d4c4cc6e8fd5dea8cf83b23d93f4c2d5e1bf

SHA256
d733b9f152156418305405227d9f1612c53542d9d6c125c264a7b41e711b9fc7

SHA512
38ebb70897643970ce22b6db7005ce022e4c299288de610560cd96f5a1c190f93d34e302ea00d72049e605132d49747835bebc798ce201e69859a5629f3dd816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cbb0e761c4415ae048f89b4de494266b

SHA1
73d4c2a44fd3eeaac7af9226bb327fbca3331cfd

SHA256
9c39a3b860b2535b8def293daad5c1a9cb1f6a13eac86b835c90f1f7bc055f16

SHA512
6d02bae2cc9b50616e50f94465c76d55ab7cd9a4ef1a33780dfbd56d3abff45f7975b366ca82a5e158e4c613636ad97bdb15415e62b148d3eb00ebe99d14816b

Download Submit