449a2c1399a5da0f2c0a85c77e5c51f32578c3102d179ff3260ec9517987a421

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

747af8db5e9077111121a98246166526_JaffaCakes118.html
Size

18KB
MD5

747af8db5e9077111121a98246166526
SHA1

147a830795981b78f1f05f40e2cd0f3bd0c1d8dc
SHA256

449a2c1399a5da0f2c0a85c77e5c51f32578c3102d179ff3260ec9517987a421
SHA512

eb7ac255eb49c42382b122eaeebf5666615ff9d67d48b018ab892240cf4dd21ea9f40573a5beca07e7f983731f0ed2f68b445bf3eb0673583d3378587c83c8fa
SSDEEP

384:4m6OlVO2THbbPnbvsbdMxis4fQDJMZA2FvWWWU:4mj/zXbCPlf4n2F+w

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
576	msedge.exe
576	msedge.exe
2324	identity_helper.exe
2324	identity_helper.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2240	576	msedge.exe	83
PID 576 wrote to memory of 2240	576	msedge.exe	83
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 2812	576	msedge.exe	84
PID 576 wrote to memory of 3256	576	msedge.exe	85
PID 576 wrote to memory of 3256	576	msedge.exe	85
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86
PID 576 wrote to memory of 872	576	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\747af8db5e9077111121a98246166526_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9053046f8,0x7ff905304708,0x7ff905304718
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,293030120541844288,14781519420736822924,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\29e78aab-f0a3-407e-b037-71f7c23f1998.tmp

Filesize
7KB

MD5
dee8b19bb6e48ce86e19d49fbbb739f1

SHA1
894603b07779dda524dbc7508c9aa81c0bed6bcd

SHA256
1516d48c239e7cb67ee41127abbb5ada6a702ad83013d51b0ee65dfb97164198

SHA512
5567945b78b0e1b22fa6ffab5e67398b850913e8abef5799cf2fa172790811fdf36e46305e539405eba3917a0a3c8fc6b7437f5fa52c8ffcf4121383769dfb35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a05e91b90a09ec65d2b2a7cc752ba536

SHA1
dd6bbf88153eba7bf0fa03430d8b4af28c0c6f80

SHA256
f95ee018960927dcedf5703b58099b821a3aa579c9fbc7d88da98c7ecc6d9b79

SHA512
ab4a9965ae4a4b141dc179b7318e1de1c191a28ff843216b382d296669d260be44e65aca13c306c349a20308b90a0b5914bee0c4871378ab9a3be5c53100d2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d80a53381f8e88e28a898101239c33a5

SHA1
2d1e99ebe2c546f0eb98c8c971847a339d24efc2

SHA256
a0316be7da4fa65a104a657561c2d0f16de70bb236d7057422c2f2a7f316afdf

SHA512
938e0c83dfe04d1b56ec36fac94fc27febe00553271392c99c112e7cd602eb91a6ac16438b3273163bf00e83ea8098b9ddfd56aa56635e160ef0b634bd426edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
480d1c1e6b8077d1e050b21c55e84d31

SHA1
6635caa39f1627e48cde3ac36356f4b12de5f1df

SHA256
ddd84d8f1ddfb2853ebbd7c8e950bfdfa4a902d07e0ecd9d7aebeed8e61bb893

SHA512
dcf09d20ead28d61ba3399f17c3feb58658aded5a76e56776351f274436a045f8a8c94e4a8ed9322c422e028f4945e2ea58707198d53e6909fd4e041643a501a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e499b51cdaec05759ff83f7d7257294

SHA1
0bc5a2c9e2453359db4db6d5c3b00aded402aa34

SHA256
be059c68caf9072dd1340e804fccca5cc222ec53dc0eed93b22fd6411f7deba8

SHA512
ce5fb5398eb25a5fd89be5d6cd523b255f028c9ef0019351dac0d61ebf096a97e186a67129d99de01da0369529a205c4217838d89fd44ad094252d0773354475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c19c4c8245a059871f82282a8cc966ca

SHA1
a1d6f2b2b31f2a1c5a163f8b0474fc622f1cf771

SHA256
6e4071ca33f50c02d81713856c34c97f58ea82973a4e49bb7f12bab2aff2922c

SHA512
539e1afded81704d7fe5170d2e14d0535339344656ba8def5611e88e27f786804ebebcb7e9739d45be126d202ceaeca8c4d288569a3021c9afa9eaecad3aa8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49ce00aff604e218f6a46aef30151b4a

SHA1
cf13ce1ab279fa90b2de5be51488d0832b6c2d28

SHA256
8b320b1ccc0fa91ae44e85525f7ff64f358421888bae5a0652e6fa99a10b0533

SHA512
da098c8c956e1a0d6f97af6d33621435bb2e4b5b548ea959cd19c40df4f4ebd214b72c38a328cba3fe93e773eed84325e2abcc2c7295b7d48c064c6ef40946f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
892c86e674a13bcf944f35702bf1cea7

SHA1
08d11b99f172c200f8180a99392c0f34dc806b56

SHA256
0295e5bc34f7107e7bf3935d7eb66fe3e13a51b81f47a3d23fb6c242d6dc2bbc

SHA512
630e6991c78c9441ef74572b5c2a99b058954205db2a93747f72d2f2e2abe8a3c1ed6825f753d2002170a39bb972fd22f7693d0c6b98705842ba9d9022accbdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
abeb0deccb372e1e472c85ca4acc8a2f

SHA1
e92ebf3307b460773b740244f7d3780fedc7b687

SHA256
ff53d85ce7efe4f25899b9241e59d9896ffb41af9f28f7aa40ba04a915186a5f

SHA512
1ada7f7bd7889c1403936516af9082b9c8b8ea417f2ff83a470d16f571b9e7e07c500f3775f1ebff1db86621abae90466ad2b16dca9ca81832820499a108acb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ccd5.TMP

Filesize
203B

MD5
a08021c1d743115ffbea733e7eebf74d

SHA1
67687067c34d8a31ed640aed17573f60182c56b2

SHA256
3d7006c6416bfa679864bc4154ab069699ca1188adfb1c32902a8f3a512d3504

SHA512
bc11f9d9c121a42c1807e863a1ef259a1500531521de40acdcf4665efe13578b5e946a3e94279e1f6bb05d1d4713c0d5560e7b5aac14572ea8662e23be13a588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0549a4ce2292e732a888fea6dfb5123e

SHA1
74540e7243616daec70698ce45f972e98d3aeed4

SHA256
369d5efd81b56422767da7685e06e0e929f02e1bb6398032c49be30b9d1b0fbb

SHA512
6cd2fba11a52fa072c9e54b4c4a258d312809c99ba3635952df82d139e057d83637f889a20d66bf8dc2bc7747b60608b8098d4e7956e86c882ef94b84c6fdbfb

Download Submit