9a41db52826ebe2a0f40bf860c5d654f287bcc3763b945a6e1b1ada7cbefd192

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c8a85ae29ed466baa3cc4d43a5f24e5_JaffaCakes118.html
Size

91KB
MD5

5c8a85ae29ed466baa3cc4d43a5f24e5
SHA1

abb59583fc16205f3b7e9994b29cbe6744ba0e8f
SHA256

9a41db52826ebe2a0f40bf860c5d654f287bcc3763b945a6e1b1ada7cbefd192
SHA512

06097cc6c383eb16f6f979c358af95f8b12a35cdab5339b3bb46e3b54f2ac0cfb926ec9925351d2024743e3a2f3c9dde79f4eeb6fe58c05ccc4a0a52b8cf93d7
SSDEEP

1536:GdD4oX6zzuOZAzFNOr7AKwS+sMjIZeVUDDkB8z/TiSNYAg39P5W9KckvZdB6cn8F:GdkyOr0Kwdj38DTimYAg39P5W9KckvZy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
2732	msedge.exe
2732	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
2300	identity_helper.exe
2300	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1368	2732	msedge.exe	82
PID 2732 wrote to memory of 1368	2732	msedge.exe	82
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 572	2732	msedge.exe	83
PID 2732 wrote to memory of 4604	2732	msedge.exe	84
PID 2732 wrote to memory of 4604	2732	msedge.exe	84
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85
PID 2732 wrote to memory of 708	2732	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c8a85ae29ed466baa3cc4d43a5f24e5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa604a46f8,0x7ffa604a4708,0x7ffa604a4718
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9352820466283005731,10449725896859233694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
deb65f3598027c7df0cd8a9fa48c6fe2

SHA1
6aeba8eedde3c50b9b04c39d71fbe9a18fcd34d6

SHA256
c331d85a9a1520472daf25dcb3b488050056232e2c2a37eabe47f5ff2f519e24

SHA512
8c88bbfcd07295b30e4607b0bbb3e2c61372f21d73abdfc228e4f1753d6a8714eaf374c4910866c5807167217aa71b4c70c88b4650e964130aa5c7fce73bf055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
dc13caab36ddaf38c6d167f26aae7f3d

SHA1
a6452d24be11467a1c8354efd0ab929f853843aa

SHA256
7170f377bc642e850a230d9f762e51bbdf92c0d772a73feaa5f608d0cad6fbab

SHA512
7ccb3ce0d1a730bca097e677c2243fdece58bd65ad0152131c6b56ff9715935f15f90e54de9efc6a525ccf723b8bf48ce05380e795fe616faba972e503cb16a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
cba9948ccedfa72c3a0a4cb0b3f24946

SHA1
2418342abb3b6d07f08833a9a7c28cd439d377bf

SHA256
c16d7f2d3331741431f5e7c576244154ff21b0210914c00389a481f8ff95519d

SHA512
f4d770fa71806f653984a1523b608373b5aefd37f550ebc9c78e4378b4972a2a1c7783c5e48a2cee97cfd407a62efc5c4749b36c69da069e38b2e739c25dfee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c19c0735f422a95f352a0e8058267f77

SHA1
ef56a255039718d7ea53d1cc2ca173afc803ab2d

SHA256
a2c4c90c744ab805569e9ec123a9a9467d0d46216a65baf68f9e7559131f870c

SHA512
c0eb8a95263867377019a3cc3f9c127aad3fb66ac82394857daaf0077d079127b312bc9a4dbf6bd7eb35dda70167a3e4dc9a71e4249e8e327e5492183bf2c85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d30031cd7f1f3b490b0aab5b738be2ab

SHA1
0bd75ebe89aca8d4348f39336560e6ee5c1b5d48

SHA256
537a1e2cc716278d07f64734d84aa55b65587973eb99aa92f70e152d05a9828e

SHA512
7c34800e44ecdcf52b5f7e3db6152388ff4c98f4624d172b119488734e2cf103319ac6eb42b2d4b56ccb00461c82380083eeee195cec965291e6ef9572af0a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72622ca0ba532bf2f81d008deb11ed3f

SHA1
9ba2c8630bc160bd8cfe224262f12c2599ca34d3

SHA256
c9a980174eefe381fd7da515c9808f4613422f9aacfdc4d12a5e4f6ba2df6a08

SHA512
3b41cfb7edd49a7e5cc36bc16d1aaf6baa8ced6f3a3d2aabeb1c7d858f7a9cb5cf6dfb6c6aae1c2a865be4b3b9e55adee4d1d1407e55f382c5eb8bb2a32a61ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
22591761329779cdedd508164646831f

SHA1
cb4cb4f45587cdf6964801a032540a52dcd9bd10

SHA256
ea7266677730a2a827ae92eb3566f01b2d907eed11fca11568f6b453121bb9a5

SHA512
aed3e360647bb0a4b785636a64abe32d3f9363f28cf2df29fd4e9ec966ea9a23eed0da2385205bcf8418e3ea88c10a477a13956f6d52398d6ad1986e4ca5a347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f1d7246be320fe6c75714dd57cbd53a

SHA1
a2e843dd018492696328190041edb1c7f1c86fca

SHA256
49fed4ae1462a038d7035c05ec996236f5e428c4967e93e01afb6e0febce414a

SHA512
a707a78c41f9ad037bb568a2610b00e392de14d6e04da099cfdb6c384580ae1737e6eb97664c178a305911bda8a07a0478b7e9d4da4b56142a3c7f94817c4d40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
c610da8c9d42e0f0412c2b0713fbeeab

SHA1
e2150616a3a8bbe465b517771e1b3967b3f57816

SHA256
b2f0b9d7028903e15350b9e784bb3a66d583d2eb22154c2ebe3be8dff5b56158

SHA512
62a679d2f351fba3fefc88285faa1cedfed21a60afa47f8de4f5f5599a8fdb9f697e592988ce17c57149b27ed26b2534939f349d0c6462610f7f814752625dff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
0872138277b609613742ca6783a132c3

SHA1
7bd480050f8ea331c0e0b3d9705abebd42ae2f6e

SHA256
293f7cd8d0b493b5c80355e8c8d070368a7cfe99ab234d4341c3ba65be6ee89b

SHA512
a441b803d13809dee67562a6930bb49eb8a67604e6e6b7ed9f43f6af3033d6e4446e3575aa7c6bc67afbbfbfe09cca3fafe82f6e18c83cb8a1193c1c96ad6831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b65f.TMP

Filesize
203B

MD5
b48b428bcdb3345540e21642586e2760

SHA1
b1bd80a9029cbe04cf4a7c7d823ce791154cc89f

SHA256
1f3eb93ce1f8d0f19fa5c02e931326f6dd80ff972752b39953927105ca835971

SHA512
1b7e2d30ff2b128964afc27aab06a48befcb13f52e4475db130a8a9b61fff96e4ef1eda48b25d72b9d5350c842a665edc5f1d16f2e4969255797bd69cb582578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1237d60c013047b7a75e5f9a5f45cbb

SHA1
2fae1fd30cac6126a733a900ad9a3760010f4094

SHA256
31d628e43cf3bfe634d15b1953d598810f79e1a2027454ef14f52b494b9fe835

SHA512
b22d860e28623316ff77ddf4f79b3ee04fc805ae977b601bd588c5f6488e0ce47d43f05b9aaa72f7b89a15db91c23e3c5b10f8ac696d437ba5755fd75303a5fa

Download Submit