2cfd129ba120dca22ca368f7ec5f514f3fd1e640ab0de8561a9f6c372b971947

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ce1098f845d87aa7259ce8169452beb_JaffaCakes118.html
Size

50KB
MD5

6ce1098f845d87aa7259ce8169452beb
SHA1

f56adc534ffb68654bb73bf281fd51be41946fbb
SHA256

2cfd129ba120dca22ca368f7ec5f514f3fd1e640ab0de8561a9f6c372b971947
SHA512

66e38e28043b9e21398b66b82051a95f1ea8249b322ffe37dcafca013d2025a8029fa02c2547afb2d28a7c843dd1fd1112c4fe5f62497f98e30774b1f66cf177
SSDEEP

1536:3ZW/wlHtNxQen1HARCidavjIQYXNXR+DfJyKsPR4dr8lVdnb3fSqBn:3k/wlHtNxQU1HARCidav5Yz+DfJyKsPR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
224	msedge.exe
224	msedge.exe
3788	identity_helper.exe
3788	identity_helper.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4556	224	msedge.exe	83
PID 224 wrote to memory of 4556	224	msedge.exe	83
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 1100	224	msedge.exe	84
PID 224 wrote to memory of 3392	224	msedge.exe	85
PID 224 wrote to memory of 3392	224	msedge.exe	85
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86
PID 224 wrote to memory of 3040	224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6ce1098f845d87aa7259ce8169452beb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b83646f8,0x7ff9b8364708,0x7ff9b8364718
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8949677141154202702,11856973911176192374,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d1031ad1f3a7b8b772fc99cbf285b1f3

SHA1
5b095ff10b3923fa4d7d9d8ebbdcb334291a2a22

SHA256
1b7c635debf60b7bdd32c2a76374fcaab97a8bedd96934fcb1a5121a25b274ce

SHA512
e6f08e6e98606356c52553386014028f916df21d8f9036a88da078599cc0bde352d95880a71bd48a568f1f176efe0af5119aa49821d89bafa827b509b5e5e143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c02cb860cc967efec6445318bb1c2386

SHA1
ad5e47d959b23a6aa593a260284d40c15c3e0716

SHA256
747c605c32fd431cd236f46f790d4d647ad17a12329ff539ffdd856b53cf2740

SHA512
d8fadc0483130015646b9f35238e10acfbc7ca7560637eb8ab963c0fe95cd1896e65cf75e834da77ba7a4de3f2f69d472d917be4aa126f8372385bcaf3a6d3e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
46eb25ce15631be24343787d22d4a11d

SHA1
59449e52b0af507de710325e81b27fe2de9a45e1

SHA256
66e5b663b831bacec6de7106e8ffdcbd1e6aef531f92d15347a30df319818646

SHA512
11763d9f5d4ff059da60098e977a896c248268378d37b0396ef03a4fcd13d252e775c1c23465326fddb103b2862112bc180083f77631815daf8d97258b323b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
518254a3c29a91ba8ca8aa2e201c1962

SHA1
b6b841d35a126674a8cbf5e8f58821f827ac1472

SHA256
6a59dff6f8f098b9f88fbd8430db5beafe4f76deba0edae4379a9758baeb7a37

SHA512
fc5cc723bc70e1ede81d973a3680bbcdf8c167f4d3b4b996b5ea90659bfebd0fa73a8ab9c2efbf8b7eec06e4a9803a2e14f9829447279bb10dca16dd454fd09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
30a071c71689d161ba7146dd53e44a7f

SHA1
fb95f7c486b97e26e93be2821460fba7368be1aa

SHA256
e635ce8613a11a9d3220c1e54ca3c45cfa3ec36d21b8ad70a5ded4bfcba198c4

SHA512
aeb89448c189c336f58b75fa6ce644de0fdd266cd81a15286d5612403f6a23c593da89756c910a624122d8ac9c376027d61d42a39dcb8516a07285cd389e0c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48a76fe79fe3924d4960c8d738547903

SHA1
d6dd0068ccaa01fa10359ec07ae83864744435be

SHA256
c727c08723525cf8d0e7a11207a498c11d8484b12d1b40f276dd85831319e42d

SHA512
bcb65952ff1913da6bc2d21cc003b8f8dccfb71f618d131931fdf482cf953d0217705b0fbd66e5e94ed5e05418b7960c2cb1e6a7a02b2078cd42f33956eb8bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e54288e2bcb27a15abbb4128417779b8

SHA1
536b11544ef0269418020424ecb8ed755aa9461f

SHA256
14a191a11e36a5e7cdc0e7e52a51ac824388a72d5475a9c8603cb512b18ab5a0

SHA512
17d58e6baeefcaca6b9c9b77d071884311781c8979c92f61fa66c3194c7a933378ffbb314e7af30a56224ed559ef9f3deccac23bf0de67a8aeb7b149ab20379f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
7de21f2ce39ae1be0dc5cc8e63849e25

SHA1
0d16094f637a1c0110ba01f32f14793d8c93a13a

SHA256
4a4b0e80e087e6c83e84c41b5fc6bd083539ee1269d296657e03fda8bf31363a

SHA512
9bd3dc62b97877b5b42b5fc39b1b8f2117587cc8a0ae22fb0b50c37b0617e9e958bebce260a12c12a8bddacbce0adaa0457a8a6f7a32b5085a64038b512989b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4a6a19996960a6a884cbf90af7d704a7

SHA1
40adf6b243f1a6870f1fc7e469602c3b86310e7b

SHA256
a671d4bed5c7d46614670205e1e567650f8d425580b1e9dcfec388bcafa4da3d

SHA512
181f062e47eedbf9c36564f1a04efe5066b98bd7e16d4b5df2747fb483fcf4e29a02b5a8313706fca8c13cadf1692147b00b79bc5fb914cfcffd749e62eb73df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8852b84a12702857d1cd9e50f39d4ab0

SHA1
3c4dbdd3e8308ad281a2ebd786ef0cffbc50cc8e

SHA256
63215e17f6ca0a5da830a8f5776b593a5c4d8e3c8c229bf8a0e855fb8344a4ad

SHA512
2e6ae507304b6d575de1e462aff739a3de802826b76a01a0803b47d29a404e5f92a049605e33a8cfcebc20c3e82aa50d3c4309e0ca0acc5b6ef7de16509870e5

Download Submit