8706c3c165c6728a4ab5cb155ed17ba0130a2d89507c8dbe6166264c6f5beaee

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74cfa110dc90ba2a6d21d18a6c874d4d_JaffaCakes118.html
Size

16KB
MD5

74cfa110dc90ba2a6d21d18a6c874d4d
SHA1

8a120ec93aa6cac0f5bdf8402d03615991d01cde
SHA256

8706c3c165c6728a4ab5cb155ed17ba0130a2d89507c8dbe6166264c6f5beaee
SHA512

7ec45498c7e9b5fe40114aac2ee6159e811b9ddf35d4f42ecfdf3c68886896f7837216c47dad293e4027ff87fbc55bf1b3ec8a5b472a03d0568c68a4e86309aa
SSDEEP

384:SC+4kETj5pFxShREyX1Q21PJYTzoySv09271Fjp:SCvkipFxShREo1QCYf489iTjp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
1420	msedge.exe
1420	msedge.exe
4532	identity_helper.exe
4532	identity_helper.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 640	1420	msedge.exe	83
PID 1420 wrote to memory of 640	1420	msedge.exe	83
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 1896	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	85
PID 1420 wrote to memory of 3484	1420	msedge.exe	85
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86
PID 1420 wrote to memory of 2720	1420	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\74cfa110dc90ba2a6d21d18a6c874d4d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12ef46f8,0x7fff12ef4708,0x7fff12ef4718
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8350590051247879705,17191153140927890252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
916d12ecb0f3b5e408ea8078db2520a9

SHA1
a291c34db03927f0a2b31c611f1cfe27fafad0b8

SHA256
bcd37e0ca17e5a7474c16054d5a6981355f6215296f24a7b88af14261d39bd4b

SHA512
c0a05973fc0ef857790570052e4152ab9ab6a6ea375f8354759e258f9986a14a431b346fbd7d343e211bb2825f7fb48d81c7f8651847e82809a3c74cb87197e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4a2c6a0a947f77a210c104305a35c40d

SHA1
cd4227c82a67bf7047cbb6afb35c113cf0fef884

SHA256
db1c610f49f44270e4fde9c9729cc5ffcd28392996e752d730d742e60fcd24e8

SHA512
caed0c164d85e5b67acda2048399e67f7c513e4fa8d2b29310b6faf234360d2a7a436e14c842188718186d58a1a4c3c3d88591797c830522cff056b014e969b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
ef93dd809749dd37902ba5351f81af52

SHA1
4e51d46a2e99e1e64d4c2a69de3cf7099b24cea0

SHA256
d718b89234270de2cb9190a5cc9fc4a00e1dc4db5de9b82041f0f4df0b78843a

SHA512
4f1af27756a49d554909a1966846118f53bb47f91cf14aaaa41ef8eadd3c93bd1dddcc35db1541eb589c434e499121f3c5d318776f4e4781d0c578fcac8343ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4bc04201d2717cf7fe53fadb2846dd37

SHA1
9445acf8fe0c79db28f45e45e1ae1bfe9f7ec87d

SHA256
e52a861de80ab77abf2112c5db24a426c353b2613937c517f153968f9da60e11

SHA512
a68fe825c7c3505d1fb1536b6219b67e10e52f9383539721cf69a0968dcb92125b7aabbb9f41ec20fba67f5f9528b2666fe3601d2c13877022cbd911630649a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7f1d61aaa4fba93545b7feaeba024bc

SHA1
a57dbfad2840773f3beca6e4ff87c38a27003fbe

SHA256
db2541fac0f3d3a6c761e2f3bc9a8d782d07cba90c80875aefcbb7e1d6c301c5

SHA512
38aa5ac855f17debbc129b86fefa702ebbbfbbe9bcde0a4c7a0e8418dac71f570651ffdf16375ebd1c6d20082708b048aef4964c5e229c3274d15d4826ad2100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb116784c8f90d0bea56e7ebed2762b0

SHA1
ff55c50106f96358b251c3eadbdbfe6f756ef324

SHA256
2d4e83c3d46aeb45078212d8d9a12039191d956cc3467ff21356a14f8a83d144

SHA512
84ccbf92f9e0d8dae321578d0ef46b7fbe2206d3fa7f0e63460154a7c6a51fa6ec8eb1f67a3383e5264ba9552d0cfad724b15188807615b77297ec20ac87eb09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f3ac1d96084aa0c8937d041fbe1b596f

SHA1
d26396817b1ff04946361be5d7cda027d920a975

SHA256
96b4da6dfb3b73dcd6541a5bdccdb25004f7c7936cf007409839835e5f6b5001

SHA512
114a4cb92c8e909912de1f3ed4f2c58eff12231992b2f8a5c2048e33225daf4389efccdef087b81245dadd72e9b0b05cc220021e449bf08be207a5d5561e7aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
670c7703462c1052e84304aec94e2c73

SHA1
776894f4033854b4bfd547dbec65f3d517058605

SHA256
bd72ee1d2b098f4d274bfdfb757a378cf49c20e4583facc94811c0979b94213a

SHA512
e8fae4795769d089b655c4fd5eb903bc1ba60b34f57012c5d661232158db2ce33694358528ef39cbe6af581bf7fc8ecdf534de2e07111406fd723e01c0f24fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
36b4e244e6590b2ab2e48693452a9f88

SHA1
6a91122fb1e40f2e0ee62432dc36ccf37e349166

SHA256
e7e68566c96665124c634cd2e7a5a829cdc14dcd67ea5f6ff53007b831a25109

SHA512
0c6c126992f65ed90ecb8d232515a459321860a8b1830ab03edb83f9f5801fe1b7676abdce154838b301033099a7bcf4ea99ef40652bc3b840d3df0d7dfe87cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581bb1.TMP

Filesize
704B

MD5
02d240ca3290e32e1a5e294e90a21b24

SHA1
c56fa74dcc79a060d781a6a8cdd090b2486b6822

SHA256
84b0debd48c1122a638b999e3a35842f7d1cb9b9fca191ce805b3ea77424539d

SHA512
80dbe20578a7da91af2d8fb9f788aeb13e5640678e1c43bcc9f9f995d5a7f48b8a3a12bc88e0618a08f350afcc6da92320b91b4879d8650f14062ffda565f269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27cd17de60b01652491f7b8ddd57512c

SHA1
05f68cc47c09004fae930d1b2fccb4b736ff2f39

SHA256
88f8f9289032ed44e5173faa0058db1061330349bcd22f8fb800546350c76f14

SHA512
072ef65698bd3e501420201bfb4a177b54343f9a2428d488d05a27d959587cf5a46ce042828e5cd024a8455aace02065aa665d8e1bf5019443affea921f8d429

Download Submit