9b5e69982a064a944dd68e53929ee42a47a1ff10a02ce7b5ac605ca54246f903

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e7a2a838f02bdd5548c8819b50a6445_JaffaCakes118.html
Size

263KB
MD5

5e7a2a838f02bdd5548c8819b50a6445
SHA1

05fbe27f69c4219227eaedfdbad6f4b64d4fea63
SHA256

9b5e69982a064a944dd68e53929ee42a47a1ff10a02ce7b5ac605ca54246f903
SHA512

97986d60595984a34e56eb6ca1e8949b2843532d247ea618f8453423438ac56909ea3e8da9fff45c4bb04218d0305d7536fcb5474dd495a5fb26fb748df7827c
SSDEEP

6144:tok01comRk8h720cRzwgntc0bLUEQpKaDZs2B5ylAikwM4966P6odzZNTrdLFVKb:AlJwgntc0EDqs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
2720	msedge.exe
2720	msedge.exe
1080	identity_helper.exe
1080	identity_helper.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2880	2720	msedge.exe	84
PID 2720 wrote to memory of 2880	2720	msedge.exe	84
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 4888	2720	msedge.exe	85
PID 2720 wrote to memory of 1564	2720	msedge.exe	86
PID 2720 wrote to memory of 1564	2720	msedge.exe	86
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87
PID 2720 wrote to memory of 5100	2720	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5e7a2a838f02bdd5548c8819b50a6445_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc634b46f8,0x7ffc634b4708,0x7ffc634b4718
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9621058354215455323,11938848747234341744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
8e3b832ceca449bc4fffd65bdf2567c0

SHA1
68f375829eb053164fd00eca5f5797af2afcae34

SHA256
64db160556bacacb88e2ec4d3283c7839f2c3a0c136a26582fe727113b7e3a3c

SHA512
a2bdf0fe4d83866fa349c54bbc580835fe00bbe2aa4ee2b5b9f5e7c4cf0d8f6b130e7b54139d2b6f7da98cfadeb63e854eb34b0690c88f90eeb877a4ef383e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
fb5b9e8972cdfe139417a663443d328c

SHA1
0ed99ba5d2576f121a3f693640c7d82d4665a659

SHA256
b8493cfb51089cc44c6d9c7eb2e9543ae6bde1cda04216fd594c5dfc7a078ca5

SHA512
53a1f0b92555ff70e123c16334b3733c7fea814ab79c2926b796d431b71fe1adc682f7baa8cbc006ae3989e2dad51b8fadc8c1ae5c222b3631963039d6120ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
83880da9ec1fa60a6da63ec0ceb96ca9

SHA1
226dcada1aab42f4d2d3e23f7f53b8e67578fb91

SHA256
967fcf7bc14a60df5413a429bcf512ec4adf518d03ecb80050c7130ba4096610

SHA512
5265738e7054959769bd826971354e8e55cf2c071d2e932cd6a7d206042f9d737718efec764789d70769290cce758b719240a00d0f7117c8d2c88d6def832da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7eba0d9a61d0885ffe10c7f9c71cf1c9

SHA1
676a9572f7df3b57c3a35434954465aed59591c6

SHA256
0a005184a2153dd0284c20b77ec423201c2ac962ea8489f13eeba13b3c6572ab

SHA512
797276ca7e7cda4e21e3e0b5e27122e218f35d7afa3fbb80de6bdec9903cdd13a34b39b0b6bcfc2a93f967e28bbc23d09d4f3c4ae486b8e3ff33809612bafbb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41eb6e73d1a8432dd653e18eb595002e

SHA1
a6dcc8e3894a0129743f434e477f37179ef4361b

SHA256
094328cb5958b33f33b327b10cc3711fd77966f4b9c9d80a92debefbd9bcb6e9

SHA512
85d05a8a88f7fc518fc03aa492bb8e32c42d18105f7a419c12f4784cca0851958ddbb019b92e8976d38b7a26a46199fb51c6ad3c55d0e5f7c8f4d8a29ad65c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ac83d93e1e91d8969d15c1b5f0ded210

SHA1
48d1fb23f70d232e970c0086986f617d03506dff

SHA256
11b2ea8ce78bb8afe02ca6a65cc95226dd4945d7387bc33834d21cd58ede86fc

SHA512
b8a66d874e1a08c7dc32d26c33fd6acc22e5d607cdf07675d8d1ee3d9499d24995d59e2cfa414405c568bd89f89fcb6a9c81fa46102e9b51050dd85b70a6434f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d015d9f15ec6afe15613f5fdbc45bc1f

SHA1
9cc3fbc5f10081773b2181e20d9111a89782436c

SHA256
5caafc6c899781215d82e203838aff17e077f994726a9fc4998a52f37a89e226

SHA512
a50f778f50d305af4854aeba24b1c3a57daabd028abcc04e5bfaef124488e783dd4f458205c8793d67b0722758bdf7ac4afca3518fb9f607b3cfe52e15e1cb50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
cbc89c6dcfc54a42778b55ae39ea641e

SHA1
6f43b9dcd893292215d201db77114ff4d9ee4df6

SHA256
9a9e9bb5d0623e53b18b348addb6915caa24fa9da2572780bed3e64a67d16138

SHA512
e07df2765517b560372444d8f303dbd6eac7b9aa068e15fe70e5826f153f2dbc6eeefcb228f4b6493c8f747082b381f63896f6c0ea956137a539c31d30214cad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809bf.TMP

Filesize
539B

MD5
bbc297cbf75b28dcd2478e688f272173

SHA1
dfbd5b708363d528ba755d751d35d157aec12d12

SHA256
31b5116bfde26a237030b8a51bfd23102c33285e86879ac04560d3b4d5fb8dbb

SHA512
49919c5db9a28816aa22e6de9960fac424433ff1afd259ed35431658efcc4fae083bc21e3552f8aa32d01799da3de7ecbcc76eebda56329b8250046699a1da41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
066fb33cde840c00e03624d20d6a74be

SHA1
a067f228b10cf51cdd9a57f15dda7efe2e70ed4a

SHA256
a25f0dce4bf6f2e02261482a83885121a68e655fd75d245b5315884f2999449b

SHA512
180d8b2077d407c7f5984fa3c5060c66a15893613d5c159c70d40aa13c14c05e69fe65987e371abcbcf052f253079ed9a2c9b151658a80aa05a3915c7e6b90a5

Download Submit