c1144350ee5b9db01b643ca858011202cad24b57bf03ec2f01339501c680f338

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e5c6c3d3ec055ee60de7f837da1964d_JaffaCakes118.html
Size

68KB
MD5

7e5c6c3d3ec055ee60de7f837da1964d
SHA1

cf923fd69ea070a49e7589c98c6f58fc259b3904
SHA256

c1144350ee5b9db01b643ca858011202cad24b57bf03ec2f01339501c680f338
SHA512

4e0fe1f5c7752bbd77da5c0b6805a2be24f6291f534b25a40813291bcc16be4db4b26ffbe99a8b2cf6f81082fd6468159744ca0ad451585028e7a70c51bcb819
SSDEEP

1536:2CBQpBq7TyJFLhA9mD2Xnp3+yBBrf21ptvefCsNEQ:2CBAFLhA9mD2XV+yBBD21JsNEQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
2756	msedge.exe
2756	msedge.exe
680	identity_helper.exe
680	identity_helper.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 456	2756	msedge.exe	83
PID 2756 wrote to memory of 456	2756	msedge.exe	83
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 2680	2756	msedge.exe	84
PID 2756 wrote to memory of 8	2756	msedge.exe	85
PID 2756 wrote to memory of 8	2756	msedge.exe	85
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86
PID 2756 wrote to memory of 3612	2756	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7e5c6c3d3ec055ee60de7f837da1964d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff089646f8,0x7fff08964708,0x7fff08964718
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17406661334505858155,3968393851877094705,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6f4d1c76b214a85836b9687f72c5d57c

SHA1
3b5b8c41f6455ab71270f9bd9e3521193524e76b

SHA256
873ce123a8e5764018bc4e643615ab79ab18f915e3c7750401d184b6c40572b7

SHA512
549341a5e8ffdcba98244c90caeb1721cf4786f4ad0ce571f4fdfc27adc33045ddcd030c5ae2157023b207be168d25daf72061e770d40590489b3e3950ccb88e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
08a4abef2dc3a68a929dc69835e6b814

SHA1
04fa6daa0de884c4119b333f3a36e4091de333e6

SHA256
acdddc1d38cec63f0bcf971651c08aa43daed14a44dae47456ea908fde5e1966

SHA512
a50d46f143d3129c4af54638e02aefe8b3467638555a90b846f6329fc8b277ec91b85ae0eeabc3be0ecb53d118ddd089b7c5fc7b177ffad36672383b5be24b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8da515982f4c7a443fe8fa34744f2b04

SHA1
af4ea50befff63e940cfa4be894854f2cf727289

SHA256
ab34245a330b362a66fd0842396981a8d0b6ad29735b291df0049cd8e956e921

SHA512
9dfb685a1d17433991748da25b31565d28c6e98040cfd133821d707a5ce19a7bf6b5d5551f2330ea8ef24e26252119a42d2d531baa8f59b0622d66656c9dd2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
150762dae592f1b2d10316e8e3847fa6

SHA1
d869b1c4a06928176e2668315178fc2391006f3c

SHA256
f2d2c6e84326b681f2da7b1a2f5b742de31cb0b321cbcd688ba31682288abea3

SHA512
5c593c75c325761edd43f2828ce2c445d234cb6e3d46147c82d072741f7d3cde04586d5f1dd6afb37f4564c9c3faf8f8a4578f934ccc6ae169fdb08d5e08c6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e98bc8b4c51b5f8be674fd09b37710f0

SHA1
bb001c91d0185ed2479bf8d6b8c27c8236839b1b

SHA256
9894d97593f590f8d656ce72f1ee327ac51c8f956b5c372c5bfb68db782c047d

SHA512
99c277b865a557b2bd1dbe2c6a4e7e1449f0ecd0973d87aa1dcb4865b6c8e22617d6bedf958579335c2aa7864ddbb7566d8508318b5ec776c3c8d05b7b05ca3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e92b7bbba369c236ab8c440ea2d739fd

SHA1
e8c774f17e262dba1b0737d8f4ea485c784e841e

SHA256
20ec6084a57b45e7ed2ef5672cc0f00ff05cecf882ac5f049e93f0ffc88606f1

SHA512
42af9038ce0719c6135f993df30ece06019d34d13220e87c9eb437ccba61f2e7aad46491db8d248a57e6fff663ccdb48d466aaa6c35ecb5305a3b013f6627986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3ee44d1434c741eaa7ae09a8ee80d6c1

SHA1
6aed17e6c5a3bac16706e54c0f12416f38493a99

SHA256
6803cb88ae66acd6ac93dc7520a79c90d709065ed207d6fcc01ae762f8d46626

SHA512
ea38086b4c4dc5bd5ca209aec51bae9641a22aaa0c3fc8d0af57e34f4055f2c6571b6f64758851a8e0ffa8279cbfa65104fbdb192c2f31f264815a7a3a533438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
1ec92a12b53d8ab38c193a049d96bb0d

SHA1
2ab99443e6fcb3b87524116a9b8f6fb856b94b1f

SHA256
0955092d4eb381989200414b264dc0ba957d85d43f2c580b73f9e7fdb9bf386e

SHA512
dbfa4d395a29b8c84d50ff09f4874a2a12966f00c7db4b4e63b99ab0b8ad04762932350c48344376dfd0dec4494013f32f7781dcddd05d77b65bb7e84cd55224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581122.TMP

Filesize
372B

MD5
a6ebfdd5b35ca1aecb1e7df6913da942

SHA1
ebc45e8e348fdb6660abcc6e6310e54698ad0332

SHA256
f911e677bd9d690f3309c1acb0d7299f04e87f149f8a6e832016698a1b0eeb7f

SHA512
f1be7e7acb9904ca74ecbe8960a2e947a5444e04a96aeb0fa5d20bc1ea16275647241344093ce1acd3043f72821a8009942a42f9fc4a5908288e81472e0c6437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e032a91e2e8dfcbbdcc34503ffdb6291

SHA1
df89089de5765a91745164ad4dd52a539845b6e8

SHA256
560d86c15365eae455c343fa61c445742ef10fd88c94227d854cb54ee82003f2

SHA512
e158ee48153a8ca501b61d39941b1edb43567c25617174dbb1cfe31ab7ea55929ef85499956efe1fd100bd79e9613d3bc321d8a9f4f7bcacfca4f70dd5dc3447

Download Submit