f975329e4b6cdf48b220c4ef49434aa6cf5fb57c93371179618a95a78dffb55c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4844da3d9bf2575ed1dd98980d384f7b_JaffaCakes118.html
Size

33KB
MD5

4844da3d9bf2575ed1dd98980d384f7b
SHA1

d0e47cfdfafefa8c2cb3f3ca159d2c2b0b10f6fd
SHA256

f975329e4b6cdf48b220c4ef49434aa6cf5fb57c93371179618a95a78dffb55c
SHA512

a81ac0f9ef232d2a969a0bbf242c4cf3efa35401586b7c6bf3cd35195ab80b3315af16b20ea5a85f0960730c3274df2df6bcf4e6a7f19ce38071e276fabb9d2d
SSDEEP

768:m1UZeHdjzSayASsQT02gA0uwWHraY22BZux0hb:m1UZeHdjzSayASsQT02gA0uwWCgG0V

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
3440	msedge.exe
3440	msedge.exe
4512	identity_helper.exe
4512	identity_helper.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4092	3440	msedge.exe	85
PID 3440 wrote to memory of 4092	3440	msedge.exe	85
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1920	3440	msedge.exe	86
PID 3440 wrote to memory of 1960	3440	msedge.exe	87
PID 3440 wrote to memory of 1960	3440	msedge.exe	87
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88
PID 3440 wrote to memory of 4696	3440	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4844da3d9bf2575ed1dd98980d384f7b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,939142712864372913,10373930552984246461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
cb40eb1f5697842ffddba51a3d9b3733

SHA1
d8e72edac10dcc373651494add3f6b592d46dd10

SHA256
9a934bd3be4c4da420f11c222383f49a7eb9caf0d427ff24a04b6f4b54cbedd8

SHA512
a44e1bbb2522aa2ab958440acfcb9ef40d75614f1c7de12da0f94289e3bc8ed95567c3481acb891604766597b9e7047dddcc35678d31897f4cdaad6cb192158e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
1984ebd3c1eafff513eb3431f01fe0f8

SHA1
60413e82ea1734f487941100f5c6b2eaa3d7a241

SHA256
192040f457afa4fb2e06de3fd19a95fef63eb7a5ddc751a9b07ab91cc8bfbf05

SHA512
4f8777692c58f80d2963bc97c50497247c3bf4ecc5f6917d68c1fe3d3304d1408b7b8682eb3819b18028a8466b3354adb1fe45833392a6be7e71fb87d5b446a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
a327744ba4299af909a53bbd672ad60f

SHA1
98050a6f9206a8ff90479d96b1062b1091ea2d8c

SHA256
93f4b7222700aea25fee14c9a3aa4ecfb776b2511ab6af9eaf7b2322a3cd5b3c

SHA512
0dad6103cd5de3e33f4693aebc12a6ce0cfa6e28a2e76347a00be7c39204082efc88a425de1345bb7aecf8c9d7684e76e4224cd5505bb161d89a185f1a169258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
95e04fc9467eb017b444e352899be48f

SHA1
efc843a108a6e02fb88e1d5302aefd2c53c54c3b

SHA256
ace3bedcf3e731b277a811921925b350506e20b07d060ea32a9c44686628daf8

SHA512
06253231589010961a6168aa4e8aa9d0846abc381d70db694f1012776f2777765996370e2a99d2738d64eb6bfc0876a1642387926a3a92662bd63d4ff5792c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f8c1f47367246a719d6cf16bb6bbc1f1

SHA1
1345805028dcbbf6f45a4b9570be5b2f622314f5

SHA256
d08d35706ee10d60079e40de2302188c90b6c9cf4cf64e330d975b9d3b0c3793

SHA512
70f51b61543a640bb62b6d1d31c10ca8d3e9da068499b9871fe58a447f4a8cba276b520160207e1e0a3ddeedee4d3ab717bb1d704f14fa364d2e3fbfb25074c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e641652c6b6f26762264753bdd62c41

SHA1
adc80cb5ad20ca65899c0b812d7968763ea96b69

SHA256
8be07f22625eb0df417880508853f8a5f3ab982c92585ed5ad6ef3dcb40001aa

SHA512
bb13baf0883052bccdbc84d08cd347daaf8c34725731ca47d08500c9a7b6067d1cdbfca6592579a14c128109ff6593d90f8ab2549cbaef821fe216f2e63c6e69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
57a1e428cd22670887ad10464e98dc93

SHA1
a58aae39900765ca9a599058db19e74b27a79ce0

SHA256
a6ec3fd9a950483968f85392e4b478579068cfa9d899ecfcc2c0e5c2dea7ac5f

SHA512
7a183c026580f25453b7c8c63d8d12e3149106d43f94cadfc85a047e4247eb7fd595f60b6e07339f1395ee5f6f66e324583738d18475f4360ff9ece7f1cb26a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50e1124194e6b28e464762cdd31fe66f

SHA1
73d5816d3d41788967d136a97c44705a6575d0d8

SHA256
1d8fce0baa9236044b50439d5f0967b31f3a645c1792dfe5eb916ea96f15d6da

SHA512
c8b495268a6caf19615314ee95ed351a1e4ffac24f45b35b1fd16ab0fb88da30ea7dc10b7e6f026f39e7cd5e8902f489636a10ba17681b0295981d96b5cb564f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
ce4a9b950cc18f45dd87a9c8da9a5e24

SHA1
e962f3aaabc70ec169e2507e8810916dfa495c58

SHA256
4bf3a6b494ebc5ab068bfd1e02752c2dea2c7a0b84542d34ed0f3bc6dbd7b171

SHA512
aa5a9a85b1000c874c53fe2d4510d48288c80cbc3d29d71ec51a9926bf0de102b5033de32e24474276d2e806b6f91bfbfe0dc4a9f977d4d25886d493fe44e964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
66ce4b24b2cc866a29b8f3eb040aef26

SHA1
3b8e9b61c3f59621caecbe4593573cac80c5c8b7

SHA256
0895e388a957262cbc532bea845ae01719031c525b1d7ac477f4eaa9be9c2418

SHA512
8cea4b4591f15b3183f3a933961032900399797005e3ebb59a38904f0492b36837d4ff93ec566fc3fb179c7c1593004150b2ade9f06010b2b65740c309bef326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dd12.TMP

Filesize
203B

MD5
3dd2e3298f939c56712095c1f0238d54

SHA1
6808cc7a8c07babed8f6497973e5283e607de40d

SHA256
fc011459deacd69520e285a75c4901e9934bb9f83c3e967d5d78038db3c39aa7

SHA512
309eccb23bef32945c75e9f6cbab13c1faf3bc0b0b5e785855e370929e4cea648c8b1f1a1aaec61e89f0837022d788764077feb65facefbfe2a3d76db32c8aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2b957fd7c0dbe732f2827e1b734c619

SHA1
2550ae62eb4599f1ef9cb5adb9459756c1c7d16b

SHA256
b1a728fade280fae1802647b50a348c2a8f9aea1c7db710c592d4b044670ec9e

SHA512
efc37d631ec6ac134ce6f1afd53e97876cbd5d59af1230234be7d557f7a4c6071e9c98d43eceac6a319dfb9c3d6e3c49e57e1eadc9ae0ef614350abafc6c6780

Download Submit