c667217d0d85ade37df7fd9484d04619ed535c88df08e92b0bc8686a35504878

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b4f0141b62d0bad0d2ffd7645ed1847_JaffaCakes118.html
Size

123KB
MD5

4b4f0141b62d0bad0d2ffd7645ed1847
SHA1

02c5da43fe5cfb77e7e50a54620c6f41bfa9cb04
SHA256

c667217d0d85ade37df7fd9484d04619ed535c88df08e92b0bc8686a35504878
SHA512

28a0dba308ca8574973a076bc28ee7db6c3f853e520f5d9373f41f03aa9ccb37f308209c8670eb964dbb5cca562d51015acc5734b7e58a339c01308a4b618e42
SSDEEP

3072:wox3/sAaRGxOjzm11gspfTFaZVzO8EFXSal7/DpSSOxstLdQ:wS/sAaRGxOjzm1qsj4xV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
2532	msedge.exe
2532	msedge.exe
2604	identity_helper.exe
2604	identity_helper.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1860	2532	msedge.exe	83
PID 2532 wrote to memory of 1860	2532	msedge.exe	83
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 2564	2532	msedge.exe	84
PID 2532 wrote to memory of 4432	2532	msedge.exe	85
PID 2532 wrote to memory of 4432	2532	msedge.exe	85
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86
PID 2532 wrote to memory of 1980	2532	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b4f0141b62d0bad0d2ffd7645ed1847_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2e0646f8,0x7ffb2e064708,0x7ffb2e064718
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14390338738567816910,377133769231487389,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4edb55cd-d4a2-4d21-acd1-97493f6f2c32.tmp

Filesize
371B

MD5
fd47e7487112a704fb4e24fc0f9e1d9d

SHA1
25417e373ea05dce7445f60571b667685f6ae141

SHA256
e39ee54feec80fc475e22f24d9d97a1da4906270a69ca5996aceeeafbeb049fe

SHA512
a23e595dc77bf86ef1225f1d653526b88a0cb86a83937b2e34634145428c3501d119552983c8e981396c234f83768881708282926d7c4050c50f963eb737832b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
bb34c2c06caf84e669f6062ed2263456

SHA1
2c67ed9b5aaa501f4ace16f824464a0d17f727e0

SHA256
d60df5b542ffa5a4c4dd838a8938e43dce7cb8478b156fb48e578a556d0b5fa1

SHA512
81c155e1fcd585a0bba307352f51eb252e39d57fe7876eaf9c5085c973103f66fa40049788a944a6a2ef72ba6582517d5729c4e255c356bb4958486cd0a8962d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c07c318f8fcfb9e93fcc779880374336

SHA1
e1505a84f021c77dae4cc53dc6562cb5d8b7e173

SHA256
b0f66bacb707283646e8d7402add5cd867d611d3a44d9fa95e1af78992489c20

SHA512
ef1a0f7ec26ab7de80937de8766828e21df3fcc274973e15b01b349fd5d75c1b77c7987aef0330c314593dd882175195f2a7726c103d25f5b756682c0eeb7442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
86c9dd87aff711041cedac8b2fcae6bb

SHA1
a9ba0916b060ac9d5e163c82907888ce8c47daa6

SHA256
ba5cd3dba1c87d640cd9457a15c6ec74fcb7d7dbfc4569d8596c66b74dfb8b30

SHA512
48ae383340eee9407163d512d1557aab5dc990adb11f2f1c9fd4721bbddca644a59a7d2ad3c3837d90ec51546bb22a3244bf5949e64a0dea0379d6c41ce6f733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f5d136a386f20a8ade0884ab296394b4

SHA1
e165fa159a3d72315f833f4f74b83ef8debb0b79

SHA256
2f9be0b2837ea771eb37d7dea5ac318d798daa0edeeb9f280e368821270e37fe

SHA512
09570de17349e6c463a6afa66aef80ab0bd04b500940f18d7a6eebbeeed1265c05ec8058b4a38d8da48185f29211e2a61deb250799ac60fcc570e9faf6c62042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81e4b24a36727a2ab8979f0ad44599b2

SHA1
1e431ba9f76ea1a9b43adeb0c07daf172c4718e2

SHA256
2fd4b79d98bde0a0abab8217ca01b9442aea9f4fd036510966f4df3cc73ee6de

SHA512
5135d9e769f70fef341fcbd7f574eeadea52bf5d51a2d0ca46d701710e413992fc2856e193724df390399e82fd837258045321c3ad71702c4086a73905d63a93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33584b10a2d12784645bc5d72be3faef

SHA1
5954c0b1aaf98928488b127bf204cbf721ccca7c

SHA256
44e56a099d7ef82e4317faf3eeeea7ebf1ab332330f2714ea3393982eebf7167

SHA512
c903a628f68b15f3eef8880604958c2b04d3bed99e8342ff37ca00f489ec6a4f5ac926e1aa4f2cba401cd0710f8c5864cc703301be66c40e5d294c604d7c23ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c0503f93a38955b103fdeb3d6458e95

SHA1
5e1ce6cfdcf5a01733a2e5b635d004708bb056f8

SHA256
f872dbf2a76554c2e2575d578436075c965cd4056be8e8c6cbc3b73fcb5939dd

SHA512
9e97083f6b9eda1aeffdc4cfa7fa168532eb9b3e4daba53a3bffbe0202a4f99bf378555dfe5181c7fd44b86cb15cb02eeb44b23d7600f8b85efd8a6ec9c6f9cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
680e68a8c8872862fe9e4b12664e188e

SHA1
374fb5d6d57581a4b9b85b6b1a54e60a90f38963

SHA256
6933bd0a4176c4078d4a4fc701de61e4be60a9782f84990ce80e011b1127b28e

SHA512
6356b297ac712694b531536a734e225e71106a550b570ba2b99ad874e7c2da8fcde7b5846844019622069fcf74f0c45b9017d1b87cabf084f4a3133f39093fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1cc800915538f276653cc8e8b7faeffe

SHA1
8200346cfc2f62d18b0e21c48e4202e32f556a43

SHA256
ddea92ad47ad2d0113eec9cd684d7406b2872d469387af7c52704ac9bd6ad06f

SHA512
e8725dece006c055059af3fa071f94868f901f0e981178a450739b50fbcbf1fc1535d9106cf117c8380e8ede2d6938301e63b1e1b0999f9b200b09ea8093c3a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e84.TMP

Filesize
204B

MD5
aedd92a1421e74f5e9649f112f688036

SHA1
37083558b520dab09a1e0e93dbcf6ad36aa41af6

SHA256
0fa34871210645adec376cfcab826fce1b1936cdf198018e2d6cc0438464b604

SHA512
e6a4fb38caeccea94dad210f780b829729bbbb893f31f5f601b4061bac8dce1b60c8c04af495c78ee0e884d76c72d3d4a2d97e61f93b69d448bc08404cf9a8e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67cb9f85a4f420607c971324892a90ce

SHA1
6017af97f40ef3bb80c80cba127209e50b8e312d

SHA256
58c6c94b85dd483b1e454888988716afab8faffbe124e06f6f055910c197db39

SHA512
04143279081d3ad1f5fe2a9e703d771fe8d15fd2ed5fa1ab47364530e42372ccc074bb0b3e676c4965baea54f8cc4f83b6c20c6817ee6beb0314bd9c828b60d0

Download Submit