9c80113d0936e1e689773ca33195b54249567f7968e11874f1bc1b45bb0914d8

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69ce15991050d8c2d28bbe08d8812d39_JaffaCakes118.html
Size

298KB
MD5

69ce15991050d8c2d28bbe08d8812d39
SHA1

c1b26b15cda0f82e2bd739fd1175033a2ebbf968
SHA256

9c80113d0936e1e689773ca33195b54249567f7968e11874f1bc1b45bb0914d8
SHA512

0700cd60e29b13bf0f9f0d553152c6e40bfccbd0e122f2e5453f4586f4af9df553edf8df714b5606449a232f8dc849a19f5d99748c8047ba29078700704396e4
SSDEEP

1536:0D+SbTTF1SjTmFNkltM/jVII3IbIre0DrnWmB6oaVLc/SJLnvSmW0RkA3Q9dE6Sq:C+SbTTFHFItCVI2dT2cDiTCH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
4388	msedge.exe
4388	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2724	4388	msedge.exe	83
PID 4388 wrote to memory of 2724	4388	msedge.exe	83
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 2440	4388	msedge.exe	84
PID 4388 wrote to memory of 3832	4388	msedge.exe	85
PID 4388 wrote to memory of 3832	4388	msedge.exe	85
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86
PID 4388 wrote to memory of 4372	4388	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69ce15991050d8c2d28bbe08d8812d39_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c15146f8,0x7ff8c1514708,0x7ff8c1514718
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3934716387952065033,8345025317612538570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
90b75936292bc04db8ffcb0a61e30d6c

SHA1
db03a9d95ec8e3886792d4b65eef0d72e42e07ee

SHA256
48512360ed6cfb19b4fdbffc03d4eac52c6ad9dbe2dc02d96111cdf63bac13a8

SHA512
bff5a000fc7de56d6d3c1d90860a56ab2df1581cc07e8c82afe75b72b4144d61babb3bf6621e89d8714720dd2942f4374543ba519b5acaf07e5cdd9be3987cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
30b78ec39e355b105fae4829901694d0

SHA1
f221d37b4d3e98ea1d35e066f326537bc56c9629

SHA256
be9fbf67e4d2ee4a799c6702fb912158693046da70fa865b64490f37b56886a5

SHA512
652ac823876e7b9c67922e70b78d8d92853323d01e2beb9819b70d76f4408558e4e76e1f9b2d96dbdd04b8036cfc7fb8d2ee89d5554480ae4ab67c58b6c04f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
45f69b679c944a32781f0a5f7186e5e2

SHA1
fc5651280c2f43caa2b308414c18d5422480e8e9

SHA256
d0043d541e9f2a17a1baf8329fab62d4109b77a466d719f8af3f9ba53a452e67

SHA512
09a41923bc7edd79eaba7f0ac9a91e5cda114e03d085d59bb32dcd6d32a9145857598d073876a85b1179ec52cfb3643ff70b3f32418779741da8d22f180c8d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7bab8c68d871c8aa299cca6ec1776149

SHA1
2cbef736cba99c776c852298624e4bd6bfd57097

SHA256
59675208c8e12b57370949ac55773d51e63478a91c392f9cf8a5ac5c6e99062f

SHA512
8068f0b25033f6abbb7942ef36e5f4138f3f65ac0340c59d3df4263d8eced64a05a81cb2f59521f492646186149ce2fb3ad9454088fda81250864aa5efd5b758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61c344771f31ecd787fdbdee640a1f5a

SHA1
9f71b110e833ff77a444c76faa5ba760c6c816fa

SHA256
c6a15fd491b9212dd965d32baa89c32fd1181213e0dd9d3dcf6a79698f8025c5

SHA512
3a6cb0e6885295acf38e00e053710a1602fe4f6af2a84b235c6b49c723ddb1650ccd1c98d5bb0bacc9c3b329c19b858ce3a39c1936fff70fca18bcce4113a16c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be3cfba3a854c67779d79d632037af4a

SHA1
2cfcc64f9faba954b03e991e12cd985050799983

SHA256
a14a038e70f651c0ac8922e8d00a77eba95e554fe6c43853afeea391da5f6e3c

SHA512
c51b965fa3c492b7df2165d8944dd07b7069a759139afad537c62d34dd2b62f1ea7beb8da7620f0951a2b3f476047f0e7f2e50a2334022adc6feeb5ade8aae43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f567a773079485b33d85bd5f8ee3988

SHA1
3aa692f4d7e1c38fb759cc935a69c505654f28f4

SHA256
87950a27252230fddf01a9d28c77fe7f8620b44dfcd58a1d91f66fb314c62538

SHA512
3cc5572ef0148addde68dadad2b708c22aef91dc5b3a33e838cae885c3a46dee466b64e69638f27aa497c5fe4d5af2c5a2bb83cea3912552222871e7cc30ab4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
e881429bb7901f4115a925b3eb677d5b

SHA1
901b40a540f508ea9dd7190b8aea6c62438fa668

SHA256
7d6c3b2bd2451d76cb517317616d08cb960615c3afe945ee0ac3df16e81e95f9

SHA512
2b0432ee9026ca731c423ee3dc32817905ae1c6c76f9362db2309fb80fcc7832171a0bebb83094f6d25cba1936fc84a5b82d713b300f27e73b14a390b027216a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0ae.TMP

Filesize
203B

MD5
9205d0900c697c7b929199b3fc74e736

SHA1
02cce4ecc2aca0aa09464156a28fcc76c811b36d

SHA256
46fe27272999b558141586403911b3ccae3f7048bed81eea8cdde66e4b1becf8

SHA512
ebfab7065cef428fde77ca560a86a3e88cce42dc343f9464a97fc29de1d38bbb38fd1939dab24cdcf6a32fb0c795a15e129c0172fbf79d8822d9fbe40e0042d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d82ee1b244a9d854f1e43fdd0938a0cb

SHA1
ca2dd613181aef96f26ad085ebe1ffeb41ca661d

SHA256
1b81b7f1fdd5e4cbd77a444c436a07e1118fb1dd16bc3dbee95df30d66a0f79d

SHA512
9ddc1a58210e8fd1c6d0b519695667b66a9867ec6b76d02f2eb6a1b1f42be186cae6669e4d330c5c7efc54ad97624298a1b772e3b7f70c7209519e0897db7300

Download Submit