858a2babb608a97aab8edcbdebf794909d54e65f17e7826762292cecb0c2584e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81cc66031e730b55b1a4380cf9b21aab_JaffaCakes118.html
Size

96KB
MD5

81cc66031e730b55b1a4380cf9b21aab
SHA1

9d046d1adfd026d5e4322ea9dd55bd5e0adc5e89
SHA256

858a2babb608a97aab8edcbdebf794909d54e65f17e7826762292cecb0c2584e
SHA512

365d54cfdcfa27b515b56e14025b7489f85d9c40910deed7cf6bfb98ff71ff2420dea178251cdfa855696500739de755d59f21bd9f076ceaf08bdc52d354d5c4
SSDEEP

1536:eG1ICXRK+kZaZad9EQ8xP/GPMRD8SXeInbflqvlC3YEwS7tZe/KvB4:J1ICBecHbUgjeZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
3960	msedge.exe
3960	msedge.exe
3736	identity_helper.exe
3736	identity_helper.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4180	3960	msedge.exe	83
PID 3960 wrote to memory of 4180	3960	msedge.exe	83
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 456	3960	msedge.exe	84
PID 3960 wrote to memory of 5064	3960	msedge.exe	85
PID 3960 wrote to memory of 5064	3960	msedge.exe	85
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86
PID 3960 wrote to memory of 4380	3960	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81cc66031e730b55b1a4380cf9b21aab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16277828966179873177,17417982742383911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
e66ad1b84bfa6b99fbfb0a909da981c9

SHA1
3f744af4be2bb4caad019275416271c974b606ca

SHA256
1687b80aba8c4fce0d7c4fd5720badfcd62fe99df3273c87465290a0e462f326

SHA512
8be5f16a0d89476251af67d5ab9dff66a3df670c8038a13ffd7e3bb4f809a8955f509927dbb94e7553692fc296805558009e147283222cb49900ecd05a645f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
01494a2222e2892c8e670fc5968d795a

SHA1
eaded904b6872f0b2c788453b38640da85a0dd12

SHA256
3dd2bf3765f6e0ce2e454201c20ca86c33f1697216d146b3584080b7d3bbe086

SHA512
d319885b8936016c834e3addbe7b02d12fa1ceea80cc2c60b84e7bb0824bf47d96b57f70c33bb0ead953d70b5c737f42d7b12d0fffbf3b29db5cee9a028313f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2ff6abd51414d19014797e66d9922584

SHA1
d9850c5d4a22bf97f7d715921284fc25f0ca5fe2

SHA256
af5404f2659cc4efbcc2d6bac198eb3f145c0f3d0f258a8799a6aa39b43c9b0e

SHA512
b92e5365b7dc22080caffc1ff63f54de5855c163020bebea2111869f991cbf2ec8a00c90f887eff0b5a3e2f2d367bd94beea245774fd6d1a1abb44a7f9f8f4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3fa407a6fcd50a6936c2fe42deb2ac1

SHA1
4f9ca21f2bdb2d915db14cd4dc04c16b8fe38e5b

SHA256
5cc042098cfacdf8898b68e8ce1250e8dea0b24bf035279cf75d738b6e6f956a

SHA512
fcea1ee17b472ecf9087105231b6ebb9a299dbf7d998d15dd530aa789b018e444cce34e00d7cbaf999f00a3e07e9e3046aba6a60bfb3b52cd7ed24da23e2fafa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
802f8a1da1799f45f71527034b05d460

SHA1
7b6895c0ba8c95f7b07eb78e26ae391b7470d075

SHA256
dd6d824c17713fd781c60bc081f48342680ec2bf21ed1e6d251a6fd66acff54c

SHA512
320e6e9dc212106b8df1294e7e438a7f4391ca1abed60137e8f6ea9f459b3f97e529c475c96fac6078034b4465393b31081efc9066a6ec787c972db16e3e9c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee962c002e3ea26849f7760ef43d55a6

SHA1
dcba11bdb4ab7d76214ef81df7c3a1903aee8225

SHA256
953aa078902f54c0a8b61f4698b63c36b1f664d8acab26a6aae54f9b003a724b

SHA512
5eaa895660fde79319e67a38091c8b8d0157a2602b13e94687f33a37373168af07ec857b018a371e231b93bb4b088598dc4ac9de9c25558afc64e43b3d9e1aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e535124cfd31cafcfbec558913f7ab87

SHA1
3abed0995243b341f0058d95318329edf208a4fb

SHA256
95250948236c251cf413842532080d939ee75415b05d003fd817bec31ec22c88

SHA512
d75e4fbdaa3a3a62e5dda2ec1a79d4262deb8b1ac20436986d435065d20843058d798871313c9558592d5b4f7ff51df8240f7b2d56686db8e2052085ac875b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2e34fc3911606da50c788cce5a185439

SHA1
9f648094b33de117becd48c870dff4b24aa10ae7

SHA256
70798c946b375fa533fb641ca68075571bb625b85e46c2e71cd03e3e553b0fa7

SHA512
ebe487ed0f9d3a67912394cd48a21630e51a103d7dd7fe4e6a5f93faa48428bb21aeaf4084724d6958f606eec8b85d00839f081ff53f1c219e3f23abc8f3b8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
5961579929475a3ce5f35e38a42f09eb

SHA1
db84916c356b31800fea484c724532c4daf8fab0

SHA256
8dd007af449959067843313787ce9a949aba7b9b43c04018465a019cde027502

SHA512
a3d9168fb67b8fb12893f204d94089e4f1ed6f967e39051c1962e9cfa192df93b175daaac1faf4cc2a2c4ec516c03ec0a71556a9c22b32e63fb66d49ce1f1537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
c826f79ab9df176d54185873006887a4

SHA1
69222f5c654c8da2cd66fd48498028905dbcead7

SHA256
cf28ae8847bbd52a7d97a4227dc9be25abcba6a3eb9c06cb3dfde10a3e8650ec

SHA512
f85f91e68d1dfa939544f18d38d9de2e22cb47beaff775ebe1193b22342e59cd395beabc189f141009a20be6e34ee56085c8ca02d97cf96b557f224206b9939a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a2d7.TMP

Filesize
371B

MD5
8dba2d2b23f1e9c0d90f8ffc108ab2b4

SHA1
25758bb4e7239745ec07e3572a02aab36760ab20

SHA256
8852c7cc232aff070c1658ab499ae0648ad25c9673e8704fdb56c9c6703295ef

SHA512
a882c1580b0f7beaf40d31170647092bad7c6b0674972c38b976287b83520bcf5daf76dc9ce8084cf0611e6fbe0a74e6a2e2dc7d24f13f869b1c356a94e09f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cfb40dcad1a883f87aac84eef7c97144

SHA1
7071ca9f042c6e164a49756fd931dab8bf632ac9

SHA256
552862f5d983e63ad6b4524ae2431d8640b8326e2be50d31d5e3ade397328587

SHA512
569242351a336edbbd3a58227d72724fa24a9aa3a2877cbc753b2a680d18760d4ebda3e6afc3e41c809f34a844dbe3bf711953c2bf8a2164e3c167007b7f09b6

Download Submit