ecb3072425862716fa7d2c490b3017b72ec02caf250c11afe3289cb3bfa1faca

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c429cf460a82e7ac6bc0a6aed1dd1a4_JaffaCakes118.html
Size

42KB
MD5

5c429cf460a82e7ac6bc0a6aed1dd1a4
SHA1

7dc515968060fb340d1f32e6683462307d83f159
SHA256

ecb3072425862716fa7d2c490b3017b72ec02caf250c11afe3289cb3bfa1faca
SHA512

ea8ff6211158a3719ae6538d6925a2957ed7cd0d506152fe0e9a4f2ce4df35fbc34d763a6fe88a35057c6d8f999308b13c7a033802961468ed2bec30f234c9cd
SSDEEP

768:zinjjFr5ySpwvCJE4SU6702i1iswPOdCXcSaDDWXpfS6fV/hBs/:WjjFr5ySUuSJ70T1iswPVMSg/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
508	msedge.exe
508	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 3152	508	msedge.exe	82
PID 508 wrote to memory of 3152	508	msedge.exe	82
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 1500	508	msedge.exe	83
PID 508 wrote to memory of 4376	508	msedge.exe	84
PID 508 wrote to memory of 4376	508	msedge.exe	84
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85
PID 508 wrote to memory of 1980	508	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c429cf460a82e7ac6bc0a6aed1dd1a4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5ce246f8,0x7ffa5ce24708,0x7ffa5ce24718
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15208280360060297884,1046609414809706531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
9be780bc06907ecbdf0320d88e6da1d7

SHA1
5af34c97da84ba9319b4b8d6e63352eb9299bead

SHA256
bf111ba484d1fe1d7ebd0f2c1e3e61a844008abb17383c81610efa5f6ceccc3a

SHA512
ffa99bc96551ce59af822011cea136142aba10ea600760012ecc3bc5391dbdd3269e365770f4650e9de12fae39cad2a6f11d2e70a8c3c73ef17cdd93b2fb1822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e66249a787091a742645a82314bcb903

SHA1
99e453898f5e7dd9b0e2adf0547aa96c273463f8

SHA256
ad87e3d03077249682a4395d559e8b074dace410320c6fe502ec219d321c9709

SHA512
ea07655711433136f4d9e9345b53772ab55eef93da01495de7fcc7b7f841de3cd46db29e11553e45f5a811f9fd1a58650d3dfdd86c6db15da5a9d9e92187a864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
fe2d9858f256a6694f322d287d51d19e

SHA1
ea2fa6795d5c152520ee8615b9b7046f3962c69d

SHA256
bd66686ffcf0a8d3758bd09405635a6844589e030f8f380e6893a414584fae88

SHA512
79e8e40935af88ee4d7581b33f07090f50d8eb62adba264d156a2be772ea33790e70150aa31060e08aaaab39ef091952b1740cc8b126cbbbea284bfa2d68f789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a33d2f70b4e5102fb35b31d2421497c4

SHA1
343c83259e5883c29a421886c7112aaa8f972f5d

SHA256
62bb07ac4106c6fa0af4e51ffae2bb895089847787d17d0afccaba1c1a8e270e

SHA512
e004bf430e2ec33af65d2270ba33f66c7d237ec35323690048aaad97bdb3ef2f48a58732353be70dc170610ea3a0ae9aaa6fff6c743c58115bf845deb149608b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d5ca8f542016fdc654888c39be96c05

SHA1
9c65225321c13b8257b1c7a67f367f1a7f858e48

SHA256
5dc14de7219e9c62e7a3d801aae7179f5d7a68c3a49e69335190992aef184cd4

SHA512
77f1071eb21797a9743d5cd0dd1720a87f1557cd8ea7dd7a2872f0f4b0c0eb61f0d33071adfff7659e67ed99fa0c6e35c31e0720ddfe69647b146621cd5a98eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7c43af01ff30bb0ad8b33349a56e1ff

SHA1
3a24d47b62f5f315674dee5b719bcb633a717f1b

SHA256
ccf82879b2b1e2ddcadd9fad59a6eb96c1a0b97df500cdb744da027d157535be

SHA512
e17a0ed9c072417c1e05f942749943f5ac156f91ab4ea92f92ea84d5d8104985c8978184cdda49447a2e43563bd19b78a24cdd0d33333d38a6596ffcb08a9f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba594525c8c9787713ff744d873063b6

SHA1
3a7e02ef96dff9b80b285fe150bc896c69ce3629

SHA256
66a5e667d8bfc0ac4193da9fbe4c593bc8d9752008d1464bfe7525e4ce92dbd5

SHA512
06ac8ce98a354a7136da0a4bfd3ada798528129f14b162ae7ddbbbcfbcba93fd59cfaa5500c07e2166d9aedc87580aa2207c2b9c681034c8eb724b81158d55df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c300f9ba06bf90e74a6f51399088f1dd

SHA1
acd22e8ca0cb7445657f744a87790947014a8300

SHA256
dee94689e3249b01f7ac5ec45a811dec18bd7fd3c9bb1f14a8cfc4cfa4a54f01

SHA512
c209cc6745cf3b5d36de6bbe62c02217a8370841d28d22772d80b14b58204cf12d8b20b3f5ff97513968dab4d1bf1c606d962e04bea118fa93680af87cefc8e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
1fec83c76baf07b99e2d0a9677ab751b

SHA1
457f4073b11397593116ef80d90ffb918898f54e

SHA256
e5c24618da028d365b32a01166f21369c63493e225fb4905d916da5711809a36

SHA512
8873a8b5bab62d5af9b5227d181e62559ca3a09ce5c9f261979fb45f128b8cb8228fbcacf1e344ae65d801700b28087b80e66c01c695e5ce818a94f16174840e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb51.TMP

Filesize
203B

MD5
59d9f10b27ea8743b08dfa6ffdd9cac5

SHA1
14577e6468c4c3c1e744a8c49f016175d7926b4d

SHA256
18f86b6caf708fa9c16e134190c05b00b108af3d53df6e1e1f08b2398ad16455

SHA512
644de17eaf3342106e3dd68fd4f3fadf085df68585a78fbf0e267f69ba4897ebadac3262d1d76396fdeb1ad4c3a17f2df3d9a597d265ace92bacfc1857794d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19bf70ed04a6cdc7802df5c589fbdbc8

SHA1
026ef8ff59ee65678911c2834cadcead8b20cc5c

SHA256
e96da7240b79a0a07e755f8cc82f678b5b45944ab41d8b6136acd1d6bba31645

SHA512
dc1b67b0a1e15bfc6641000baa2e9050a68e042bfbb2349e313c3e7269fbe93494fd447c96078926ac31826b6b4bbd1183aee9a5ffdb52d69d125a5118df39a6

Download Submit