4d51da1c1a4bbd8d58a35d66e4c22aaa925fa893fe519ecf7504fe40087c0126

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a17f60460d7bd9561bcf60275f1a62a_JaffaCakes118.html
Size

43KB
MD5

6a17f60460d7bd9561bcf60275f1a62a
SHA1

ffb6a56a1869b2a05196ef1c681d0af2ebd161fe
SHA256

4d51da1c1a4bbd8d58a35d66e4c22aaa925fa893fe519ecf7504fe40087c0126
SHA512

c3346be3aa8f13f2588e13d6cfc422429a0682ca256d724f9a9028088626e1bf22ef8fcd3f2095badf3467089f2af68ad6c9cd9e9baaddb72a3b4581548c88ce
SSDEEP

768:6dyslIBmU3U2a8fDRS7pRMH4WdZo7XbZ7PCRM:6dyslimgU2ai8NRMY+mXbZ7PiM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
2996	msedge.exe
2996	msedge.exe
3188	identity_helper.exe
3188	identity_helper.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4020	2996	msedge.exe	83
PID 2996 wrote to memory of 4020	2996	msedge.exe	83
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 3920	2996	msedge.exe	84
PID 2996 wrote to memory of 676	2996	msedge.exe	85
PID 2996 wrote to memory of 676	2996	msedge.exe	85
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86
PID 2996 wrote to memory of 964	2996	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6a17f60460d7bd9561bcf60275f1a62a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8030d46f8,0x7ff8030d4708,0x7ff8030d4718
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4384748853741069031,4027176113592949681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f7eb2ea211979f6ea0867702837652f7

SHA1
90c7df8871b6d0beb67148349261a48287f244da

SHA256
2672bf7a7df5fea35d3b7169b6ae565f35db247de0bf5b612d80aa6aa8f4a7a2

SHA512
0e3bdf68f6f5dad0057140a9632563f90b6a18f7582ea85516173226469fe91cda5bcb8ac7e68328d95f8e37773d741829e1bb21c73695019dcd5b6e96049b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c9f71f5df8bb24fb5c440a8f7f0c2c35

SHA1
be3d589ecee6fbca8033b793f8244afc89a8e0dd

SHA256
cd8a3802a9907fac205b05d0952432b56671bb59ffb7411112ff7de20686519a

SHA512
3b8607af5aaf3bec671662bbef49ced4d1aeb03dd15ac44189844a849575b7276ebe63b5f95dd21d4df25f4959ade7c8ebb181e6005decebb29116bf8efea890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aa85953ca346c4d66d8a24ea726efacd

SHA1
81b2ad770c88335c8b2b9288bf0a429baf13f7c2

SHA256
00c09698586f7a527dd8dcb75358aba7551f935ea5d0594b4f89fd3ec16257d4

SHA512
c11fa05338eaaeea4fc84c3dadf0b169ff2aef200a93f245712788e04827d3ba4b4cc1c84a0940ddcb501de46dd2c4b4d556dfcd8881de0a55e77f9225dad55e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f33257d088d73f8dd6ee02bc3a3375dc

SHA1
50e74f022864ddb1a98ccc50edddf654f9bf2d31

SHA256
06a748486de19d777d18abbcaf7d6a08a03eaa18f667e45b149db73385a6723e

SHA512
9caa14e37b4881e83ac0e78467df02740fa5ac3b1ac0a5c0dc88770eb813b050289af0cc51585378c8fa4a9358a2b853285049b4557938780794af2306d27f67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c694ab553f94e4732c7766a720162483

SHA1
54efe84304149864908d2982409c553c058d03ae

SHA256
fb563f6b83fa14a0da171932f9fb2753fcbbbbe6c651ce50bd25e42bbb9eb990

SHA512
8369d8c9a7168a81cb4df4299ac5aead9b55ea90b44715ff4a4b605d70a3f80cfe7eed1b29b163cfa165b2fb9ee0a643df9e4de89846f6f40326511449fb8a1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
016fb3b314462fa70923d639995471d9

SHA1
0771222c8087f2963e3d90cfdec20b7a1d179b9c

SHA256
39c129fc18eaa85c3c038a5dbe1d595443f5dd8afd307e3fd01e96368d96a11a

SHA512
5aa1edb2fabcc8dd771b06ec478f9096dedf9e959b1ef5a0dc59a06600b74885b04d3719a3e930a0f584491500fcf273e6a89f674c45fd0b27318fa895528854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72e84730bcd3c2935df810d24467c719

SHA1
7198b5e6c1bc7d752ada0199930fa87f20d37092

SHA256
ab5f111360d92fb592d5d499abb16d842df7493ba7a982bdacb5c9971b8d7b8b

SHA512
904c84eac22eab23d41e3117da8a8bbdf5be4afa9d862a5ad1f1c9a391a072573903afbad2385118f1f229be423a2b2aeb508894c84b2b166faea1648329ece5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
c3d7a3bfba728e06f9fa30b38d43cdec

SHA1
f45838a16df03ba22abbdf1736a83f5dfa9a2150

SHA256
e7bdcb34fa2676669f0d80d56aecd2ff6572afefc1c78df18f8cc2ba2211774f

SHA512
602d2048f043eb82f96852af302e05c79c8ebf7b6f69d0c217aec05d8f67fa970a93e3662d2c82d970f5dab234a90550ffa3d17f056216b28e9ec04ccf43350e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f6c4.TMP

Filesize
538B

MD5
2a52fc8db9712cde66450e85461b675b

SHA1
9715b2df7fbe1db311c8b6e172cef112af5484e9

SHA256
621a1eda25a2438905a0015606e66746249384a1109f6ad88709d2deb725853d

SHA512
18773a2576106be9469190bd3daebf4b3158cc41a5affcb18f4bb2de2232ac31351d95d9e2e8aa24728e8f16d7debb23837cbabaab3241ba009842e261348043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ebfbb1bbf46495ad0ab5820c7caa79f

SHA1
6abdff911867c517881145b6127b94c381389410

SHA256
1bf9741aeb6c6c45d397da801b0ba89cc1e06d34c32ae3da84e86290d5210954

SHA512
aca96554ff95caca16208cb36d19f9fe52295fcec2ad716fd6910c893476b0ff71737fa6306db0e29054d832799435ba364d8add3b573262247f3805005e6430

Download Submit