4a2267c02420c1df208c6d68910575f1f3eeb390b0404db96e042e2f839a9ed1

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fdd031bdd1839f06788f22064245be2_JaffaCakes118.html
Size

56KB
MD5

5fdd031bdd1839f06788f22064245be2
SHA1

1061b49ae380eab52cb7dd861d0fc17324333d21
SHA256

4a2267c02420c1df208c6d68910575f1f3eeb390b0404db96e042e2f839a9ed1
SHA512

7eeffef1335a05df9608f48e1cec011087f805adf101fd75b5daf0617cc322be5019855477e4f40fbf966fdf8353f397e2b2408d88994285f0c608cd46fadb05
SSDEEP

768:+ROquZd9nj8Mbhmr2Kt/n6uzzOJjcrldj1ell3ifpSZ125xjD/hZWhoXI:+ROqAj8M9ZGfrzzejozJK2EZ85xf/ho7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
4964	msedge.exe
4964	msedge.exe
4796	identity_helper.exe
4796	identity_helper.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3452	4964	msedge.exe	83
PID 4964 wrote to memory of 3452	4964	msedge.exe	83
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 1396	4964	msedge.exe	84
PID 4964 wrote to memory of 3568	4964	msedge.exe	85
PID 4964 wrote to memory of 3568	4964	msedge.exe	85
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86
PID 4964 wrote to memory of 672	4964	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5fdd031bdd1839f06788f22064245be2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9584f46f8,0x7ff9584f4708,0x7ff9584f4718
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7719973202804618240,10679450284355210328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
d7937a531183341e9e2e8f3a786cd756

SHA1
8ca4c466d94dd91f2c43bda7f10e3bd9135d9584

SHA256
90e335c1b75af4b6fe4f37bb3c9c2df31ff4e0da3806bc1e0fcf39b7837ed445

SHA512
840ca7f63ae508984481d1938587626159961ea2675f7dbb2c48015271acf41cddb48db7f9fac00213d6fa893de28755c1edb0ed212887ba1f502b7c96155b7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
70e24827e16c84c6c3429574a5bddf9a

SHA1
fb0c63e32a8ce9c52a9046c469cb8cfee6fad2af

SHA256
6e7abe1d89ed657e46941388308d9ce1a55a5d32f95f273f78f947f8e635ec05

SHA512
b20961eba7f2b9d2df4222bc15aa20c3569fd37465452c127ca3149ff25c7f0dd30f13925bb4ce14de373ce77b2478472a8965aa2c10ae52a7ed130cfd675aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe3289551f55e65ebb30ed86b08d42b2

SHA1
bcb3bd75f2ddfa8fd16e60bdc99e95b130a12da5

SHA256
d340646c5996b701a516f812bf6188c8236fd6e0466866eae37c6365eca3ef0c

SHA512
55c7b8c4b4d6ed57bc8f34cb76c71922345750943b679505ef1a02b4c967244f4bc7172c3e3a5605b26efef5562edf9e80558c84423bb4eb9a9de562f264397d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4391c49ac36e00a86c0182c337ebcb54

SHA1
1b60713608f9cfd4093ef7339370351af4859e0d

SHA256
11b107175145e22601b977e747d1fda8f7b35adb5c6d4e6995214d844358ebf4

SHA512
1d152951054c643edd1cfa7ee54aa6a9936f43b88c67ec03c5d04b2f11c8e1d9e6dc0d3876a2e1c8f2620dfdcce7a5037305f204ae53b28226ed8c986d830c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a09e20d6712518068324cd977c7f74dd

SHA1
ccb9c64d18c9460cee272e766f38b52f1e08629a

SHA256
d2ae4e7dedde91810bb5fc1335ec2c077cb9f3265441e9e051175247c2c688b4

SHA512
7c4b7c04bd7f0fd97e088b5e526e50c8e9bfd5ca4677afecdb29529a2e9021a003ce2a93c66fb76f45edd727a48499db41a2ba73b0dbc492ec00e984be91ec5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
21ef422b4a2788ff6c2880ba390f74c1

SHA1
a0d3f9e74aac76d87b44d939aa17d7be82c04d44

SHA256
44e7f9feee00e720e2ac6c4ac6c58065bd5107ed8638bc9cb273d46172b5a581

SHA512
ad991ce0ac3d19d70066f35254b4e0ab982dc0021217b891f833607541942eafb57248c3f01afd90058b26635f04dc94e9f7c2b6aa6c83b785901d0e9a284b72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a558.TMP

Filesize
203B

MD5
0facc8ac9d9442469a3d0914c4e0145f

SHA1
07e21a3b90d2f91f4b3406c41a6dd7c91e26cf6a

SHA256
bbd6a8e77d359fecef94a7c47a891883df64d219f67c42f28b562a2fbca5dfce

SHA512
dc34e082cc5b56786d24db7f7cd2257154a2a1446362ff384223b81d4e4313ba0454eba6bc7d53479c676133e6cd7bb6545b44ab7241fe133b3a54637bc1f960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0aaa8f10ba21e9a81e19da25ca27ed79

SHA1
31a65b76e8d654f6a31d4c92393aec17cacd0a0c

SHA256
70896ba32b3a90160bdd67d293e7c3d503ab455cb28759b5c273eace3ea7af76

SHA512
c4197f8d5757147cc1f41bd1049446e00e5244ea78fbc767fbdbf43e962ede63831f97d6066a6cc6438c57984e4d8c91a0a37c6e1675da3acfe86025365fbdc7

Download Submit