121bd2db5083331c859d01fd6926d27b93439dc8bae46bd25ed7c6d1fd64a819

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d2d914329da9c6f390b66c7306d655d_JaffaCakes118.html
Size

73KB
MD5

4d2d914329da9c6f390b66c7306d655d
SHA1

19e87095621eafd757da58afae3be4dab39aae2b
SHA256

121bd2db5083331c859d01fd6926d27b93439dc8bae46bd25ed7c6d1fd64a819
SHA512

a77f98f9775a161e64fbf84d0e3d3ddd9fc3e6c92b69323a7fb4845ab5d2863cdc118c5dea34e0d77c28f51c242ff7322b343448506326304ebf8b7207cc374f
SSDEEP

768:Y9t56EJjFDAxIAXfRDP5BQuCaxTLHnpaUJFD+faDchN28+k1/icsEic:Y9jpAxXfVBBLCpq4hN2VM/i5EF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
3116	msedge.exe
3116	msedge.exe
4272	identity_helper.exe
4272	identity_helper.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4824	3116	msedge.exe	83
PID 3116 wrote to memory of 4824	3116	msedge.exe	83
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1572	3116	msedge.exe	84
PID 3116 wrote to memory of 1380	3116	msedge.exe	85
PID 3116 wrote to memory of 1380	3116	msedge.exe	85
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86
PID 3116 wrote to memory of 784	3116	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4d2d914329da9c6f390b66c7306d655d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb4718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10926760079591145941,3872012945887348362,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x51c
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
30d6cdc59d3fb3cb633ba5fa5841b265

SHA1
755b81664da484e773314743615745187d0c02ed

SHA256
235c2e332e16fb763165ce1961b8d4bf02fd50aa2a4ca3fd1ff6fe916dbed891

SHA512
75cb0f112ffef834af9927291f3e3516f75bcad10a205d6b7c590f82031317d295e0e3d2675d11521200c2130dd896ffacaf0a7775c92a8319b5d474033f564d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
20c7e02b2f53c5fd2be953affab965ad

SHA1
2a080c1ac392fc3b043583729c3d079504d08ce2

SHA256
b2af0b076e2e71f73fb391f703eefe40fe115b1ca7815bcbd92247f22316caba

SHA512
62767b71d9fb36548e0baa54a2a4ac9922aee3d51fc7482048cfb0a0b936b1ba43d73e1a39ad9e642b240670a4ec1df76e33cc0e2bae605cad5d2617063abba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
abdcecd56350e8c6d5fc5a0afb9894fb

SHA1
984fbb2c4f1c745a91c82809c4515b5a6e7ba6b4

SHA256
57136aa9b48bc77632e13a986e79b08a91bd0e55c57b190f8f75da5bdb6051b1

SHA512
94c6ad362b0e4b1ce93a2fbca3c5fa008b0ed4dbcd4f52d13715499d14661551841c832376ff69267cea745cc2e0fd2e87ca3adc6ae16c388eaa76ddb2a8dd61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
db2463a17c2e7ec8f6718b6af48f18c2

SHA1
97ac8825d836d41efd43721ea7d269050570f3ad

SHA256
58be88f2a4b7bb3d2207b6bcef3c5d6443159b4897624545c475b4a07480eeb1

SHA512
a1fa711a7c3d76c43bb6bfd9fe8c2947ca79d72ab47e76c8fcae81b1681e1733c155df8eb7ba0f5c63fbdb220193de85e3aa7b4929d5f9882f530f87c7f4ac88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d40e824ff06b3910d7dbd2c1d5496eea

SHA1
6d05ea55f8861f080d73a63ecd1662df2c5d7919

SHA256
7d4da00f0ea359db14189d147ae34e0ceba973865e27a13bcc0139233a806096

SHA512
e9070e0ec97082ca97441933fd3e2f3affd7804387b6036770e47407e13cc4dbc805f545571a6614b73c6c5897b85999eaa964a57bcf714217f537cb22f8466e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0191e7e4af8ef7ddad1ac7d436f9998

SHA1
f5f8ef6c0f6bb66509703c65a254f183b724e1c2

SHA256
193175fc3bccac3342d256fd8a927856ddff9776a7fb529d53ea6664b2cd6ecb

SHA512
4c04eb9c1e1e57bb1ee1b92874088eac2a31e8ebae4c7e067c09f162e845a3a42edda8fbfd60ef2b492203deff5702801aedd11815c721fde729fd689eadffec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
63960e30337027e73796cab6f71d5f93

SHA1
42914ee10128f04d5d873f192bb7086c8c9ad1cc

SHA256
e27bcc778a71c061516a24c16fa7fa07b969c3c8ec732fc9124c77a1cbfa4a51

SHA512
043c6082b82802998e864fe15c9b703a87edf78cfad791a0217b5bfd51847073bbc26d85fe0098f81fe40c71d76c6e21d171401214f6e84a1eb23b891a7cd9ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4d415c79171f7b45cc11115c5ab89271

SHA1
f558928eb565b2dfaf604e85e7f20709ab80c130

SHA256
1f6d3ae29214ee1a02947dd2e60ba7cfb377d413b894017f0443f79b4c0c90e6

SHA512
3df5e6d86e2f627f98fc9ab90ad3d12f389eb7c656d55d9d6f07698e4d3d108cb902985c327e29f6b0cbaa5512e446b1cd9ff29ac0548e9df4c6a2fb35d5316b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ac6.TMP

Filesize
2KB

MD5
ebf22c1bd40f16438539d3513ef10504

SHA1
a301bdf5949c10488e032b267870cb9d624744f1

SHA256
b5fa57fc9af4500801015cc7c94a7ab484d048029a1a54ba89a4e4a75f9a2d6b

SHA512
da74002664de3b60cb8bc6237a71b7573c69a6fd122876f1fd85ea7cb3347192f4fb25090ae0004365e161d1e60fed9efc7eb2b92c1ac15447a9af11859a8d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
69cf53ecbd9586e1da819bcd4d8bf077

SHA1
efadac4fa4386758a1cd981aca42f3193a62d118

SHA256
16e4fb02c8df74d9656c1eee14edc42d221acb60993b40585e3877ab599ddfad

SHA512
c4cc9bd330056d745b5be9258341fe38f8bca481883e61bb5c747293fbac2cb85aceb624b2ab73e84d0a931df8be66a99665afb6c35e43b058866f16bffac2a3

Download Submit