85de9b0b4e22de26620548cfee7a02694eb131621a849bb685389a44c739a777

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68203ea4c20cc8836d2586132ff8c7e4_JaffaCakes118.html
Size

70KB
MD5

68203ea4c20cc8836d2586132ff8c7e4
SHA1

1bb14c9d87b35b1a9f0b364b9066dd97c5d124ec
SHA256

85de9b0b4e22de26620548cfee7a02694eb131621a849bb685389a44c739a777
SHA512

eed220d175b7cffd9267f7675913e7baf522facb0df6fdb3a5dd3f0e7c0bbd005604555003da39d01a9e39792fb1bf6d44bb12742a64fedbd84a47e31ac31600
SSDEEP

1536:bRp3HH2lFUn2QQ04OD19qDMjjmiCzj6Pixtvxm7:bRZHW/I2QbvqDMuBj6Pixtvxm7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
1652	msedge.exe
1652	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1092	1652	msedge.exe	83
PID 1652 wrote to memory of 1092	1652	msedge.exe	83
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 4200	1652	msedge.exe	84
PID 1652 wrote to memory of 3964	1652	msedge.exe	85
PID 1652 wrote to memory of 3964	1652	msedge.exe	85
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86
PID 1652 wrote to memory of 2612	1652	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68203ea4c20cc8836d2586132ff8c7e4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a64718
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13880461974672509819,11560131736908513012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
dccd543e6b04f27f25951078967f540d

SHA1
f7e27fd2fece3b0b6d8fceff0cba31a8a7a8d4f3

SHA256
76b5ed9b8b837d60fe90e3d0380a465f438ff9cb542c0e642918dbc065449cd6

SHA512
315e75bc67d857d3a4963317bf12dbaee5ce46bb6191b55e8f4e295ffbae2c821b1445b54c4297a429c05ae8ee0bb92c3842af03bf2a0e56b8c769437722135d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
af68c795ce9c3fe33c081c83ec6f1209

SHA1
3ed05cbaaecbb3f7024df32fddc6c71257bbe269

SHA256
2dd75108d1fb83a98c1f32622cf9533bd5c936569214969d4a834db487025898

SHA512
3c44c81795c62c3102c214d20ada5b0681f7d23f9fc723fd932eed6ac77f9134ad31ddafda469fd065a471986be69e4d33c2325cf0435f8df59be3dbeadc726f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2dfa2c9599cb2fdb75721b6f2e472b9b

SHA1
c413aa088735511a484fc5ed56d310d23644b5bf

SHA256
2d0529309df7dfedd071407db772f13642d7f26fe2ba6983556b0dc1ad063ee2

SHA512
bf8a0c5631dbe4b2bae5059f3b94d421c989b53129f4aa3241d56d43feccc6ea732601d4a2162ee18fdcabac227edc4d758a7a85ad27b7357636fd3f547bedc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72b6ec916ae26bfde05dcf35da2572ef

SHA1
0552856f8e1c3b716a38e590d26582b629260920

SHA256
0dada8d845e98a1c3b31ce5e69a01fb141082a4fa19e4ed71a656d61093da775

SHA512
621368d5e0f496d7c6f15a0ba726fa2e811bbfd375696f4ff70836c4809a12b24d71b4ab46fb885dfe01af793ac964f7800d09a369da20f08e0eccb32fc37346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1dda34cf212681a14f3e8f7c58008b1a

SHA1
2234ffbd117ba3b230232c5c478826131b9ac310

SHA256
803a2641350f9d8584625ce243e4d2317578f5c31b7f58f0db2772b6d698f1d4

SHA512
a0e3ff3fd648869d2f499c7090467f2837ea245a2d52b8c5f06b86f632105e5423893087b14e9ec735dde2e4143a2cbca332c9970390110118cd371eaf7c6cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4e7f1cc88829b3a3f61e3f95eb124c4

SHA1
b29396279786caf59db118d32398e547457e2793

SHA256
d76082105395188740f896fbe18af962d96ac1b53dbd3519bb7fa0732d7b238c

SHA512
4020f274f1a77727bed75b1dc98e1912a76b0e10fe5056526d0eef7d5680a8f24ce5ec09eb4415f8345a9a10776ad5af98d06b170d0d14688a538cf8bc272618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bfea37c353a2181f583e4ec7dda5df6b

SHA1
2ccd8ca79825d60317d1bc43d010966c83804212

SHA256
57a7a1facb3e6ebac5b1751e2d884341494b2a978ccf3d0c7339bc19be8880b8

SHA512
fb1ae8c1602b649c9bbd11a419512c58986fd77ae67622eba400a9eecbdd6fe6a70843502ba2520c76a018e0783551db0001435286c5c0252c9b556c65e37e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
1318c100523c260a21fd83bc3560ba3f

SHA1
2d039cb2bbba514ec66536d44f869c619486056f

SHA256
2b0fb9d327c7b1207b4efe4a99554f27744adfd0f17f88025cbaad6956c5f9ba

SHA512
21a10ef041d59111f449a7a15ac2638ba2f25bd0912d78fc63391f65f7ed3b47a5a7d31bf6d6839fcc7bba9a34a9fdf4865bf5e5b25f0c8e02c4b5eb5d5f0bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57afc8.TMP

Filesize
203B

MD5
e35420ae3a987292b7764c14508399e2

SHA1
06680c0a1bc781e03bbfb1da2ee2fa1f5c69101d

SHA256
c42dc8a17728572270db6b0dd69389da449e9ef79cd3bb1d9b6b541f0d18574c

SHA512
5d596c0fc5db1531d78c3732cbdf08e690fdcd84824b28e9cb6e156ab0aec8a8e0a83e9eac05bcd76f8624617eaf338d8c434d7f8fb6f64eea42e05a2e36d2df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dabe37594bbce46549fda5bfdd896cb7

SHA1
cfa463b3535b50ae62862bf305377a9df0d6261c

SHA256
838aac977fef0b27d50832036602df68a8fb4952d5ed2f1169576462f8eaaea2

SHA512
525e0ffbce8a4c23e2431159ee92e4256a728a8af04f773260bf08fb168b7c42339c6a7475e790076ca064a2b1a45197887fe9a44f3d4701017158bf29bcb8b1

Download Submit