ed8df591c4dc0f130bf0db09b64c9044d891210896883be89f6ae3d0e238ab47

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

619f60fb6cf6033ca9d11677e4226947_JaffaCakes118.html
Size

302KB
MD5

619f60fb6cf6033ca9d11677e4226947
SHA1

f2b96bf0d4fc06164fe55a24d25301dc8914d191
SHA256

ed8df591c4dc0f130bf0db09b64c9044d891210896883be89f6ae3d0e238ab47
SHA512

61d6915919ecc244a88b2e90f87d526c8292872720f948b81818e4ae3c5547399cc1d5967e999f9f215e2f331d566ccc85df9712d7dc109997f9792b4e484e39
SSDEEP

1536:U9YpD+SbTTF1SjTghwdiNkltM/jVII3IbIre0Q/Rms6oufJLnvaQIAdQg3w9dE6l:9+SbTTFuiItCVI2Qw3cDiTCH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
4776	msedge.exe
4776	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 5864	4776	msedge.exe	82
PID 4776 wrote to memory of 5864	4776	msedge.exe	82
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1628	4776	msedge.exe	83
PID 4776 wrote to memory of 1972	4776	msedge.exe	84
PID 4776 wrote to memory of 1972	4776	msedge.exe	84
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85
PID 4776 wrote to memory of 2092	4776	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\619f60fb6cf6033ca9d11677e4226947_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa682d46f8,0x7ffa682d4708,0x7ffa682d4718
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17446797800451755950,5603998468214166499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e23c5269d258de16cc79525503f8d968

SHA1
d511400c9bcdb811338bf7023dff8278fc00f7a2

SHA256
93ba84a705394560a7252460c31b94b6e72d3d9ca38fa1a80fab2d220d264949

SHA512
51b3f7f7f5fff80a6be04096cec04f9a172b9037923259c5feeefcf2caf3842a8e191c846a52c6e58e89b90f82ede4c98ddb7a5476ecdb067b00503664cb4497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c7cda14b7c6c2a49947557331aad3031

SHA1
7e305c482d95c21bba69c56c7a76d765f3e98a55

SHA256
2547a47527f8de6f91fdb6e9caca695541514bca2aa8bbf42a52377b7e031ada

SHA512
513bef2641e04a42da783ca3a8a8aa2a61691e2efb29c1ec78ab9fedeee8d6479dfe8c610f6a5b02d0d566f0076bbb6cee0c5a5852b51631eb721581ceac45ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
539b6b7da81c72d5c7279f3e05404149

SHA1
0364a70e7351164fbd522248a8853d008e9afd3a

SHA256
64cd25cfd7cb8180f568ffa892d1f2f22966834fce8f44d657b8aa13fc72c3ba

SHA512
99795149093e6f63de4127f58abea3169a765d4c56e5c327618abf3c4a74531e7ef9f10bcb6d2114e5893493993a8385d736fc050db18baa07bcb3a7891e5a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4eea0be9183f19531e361b05d836ede2

SHA1
5851142e62f8c3ac4b02c8bea938eee149096abc

SHA256
efbc15bd8e1a60db21dd984fdfe3524ecd3780cd2a1702cb6bd795a159b3decd

SHA512
d4c5d45083ccab4662e868e499f58c9bbf4e553021bac4a0d1b42b64d3421996a1f0c0229e4208db879f0b8e28027a8c9be4ebf36655513541bb4d22321a5ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a94e2d5247f8e6ac4ba00e89cb803187

SHA1
81f02d2ce1934998b17a434f71c309d5bffbeb40

SHA256
b09cc2e500d9c233d0ab68b3e597ed89503a70710389c2a10c40424b0601fc49

SHA512
bf95d33cdd032cbd5ebbc516125b861837eff25bde31bdf5606ec907a1df93118708d0a5a61838ee1204b5bf9fea6ee43463e866be5f234a8dfcd4fa94206d6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e84d4d502662718042ddf293f00f50f7

SHA1
0eaf3e84fefbfe411c0d20e38d3afab8adbdb25e

SHA256
b2c3961c67ff23096bc830cc7f5d30ca45b828e9e2fc222b487c7a31fbf25bc3

SHA512
2e1103ce21db0d13be32d42a76c7827c739244e4f9a5f9ea4ee3a485304ee647fb9219d19c3207a6f24776624d62e40034ad8f3daa107559cbe5c385bf4f7499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b672d2742c6c93d2891325e1011bd36

SHA1
0ec0d7af68ab5b701a25e73622ff74c591026997

SHA256
0e893b09e6f93d8c158b1b15014c195421dac9d75b3fc2c8d4024c119285d6dc

SHA512
7f57bd4f484d21e8f75bf1fd3bc75e0f9428049290e32ea787baf73aec835699002e443adac20825f8a9bd0152adb0171ffb3d2e59c3941f9d47536849934e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
d1aa05ff61bb42e64af4a40de9ff4c4a

SHA1
6153dd5953ea639361deb46885697e6bc2f881b1

SHA256
5ca488f0aabbfb416000b9b1b55b05e3e4dcacde092820c93006593bca349a4e

SHA512
baf3efcc49f11aab54b7a6e55eb881acdc1d4b79f458c1507df09a7323ac138c65206ff7570074ddd02e11cd07db9bcad81367f9ca060bd356a1de39569622ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b3bf.TMP

Filesize
203B

MD5
7406e414d4ba5b65e8f4d29a60f26c98

SHA1
2f89aa7fcc21059dbaaf0703e457ec61c1e46b5d

SHA256
1b29271334b4862549cb1a3e9f61eef991eee2bdafc535bf71f3e39a85fcd16a

SHA512
9639a9d2c08cfdfd905aa6e92237a917b6ae172b1aeae02c20053cbd123234dfea65e45c0ff9400dde1ad8348954d020c84657b0d634a9d1632ee5ebd21b5cd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a516c0214e6edd332bd9f9c051ad9267

SHA1
2ba50ff2382705f6614fc62cddc9710fad1865ec

SHA256
4bb2d602208c71b8c471c4fd7307c2ef9605ce0b0e5eb7ea3ac2a4f1fb99d0f9

SHA512
87de583bfe2c0b540e5cc271e930b8911b28de32293e13e6f9be150a91d4bee4cdb4d98134194c7763b343830461c1d660222f89d3074debf0bdaf20d991caf1

Download Submit